CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation and urged rapid remediation under BOD 22-01. Newly listed CVEs cover a range of products and issues (command injection, authentication bypass, deserialization, resource exhaustion, integer overflow, embedded malicious code, etc.), including high-profile supply-chain activity: a malicious Nx Console VS Code extension (CVE-2026-48027) that led to GitHub repository exfiltration and the “Megalodon” campaign that injected malicious GitHub Actions to harvest CI/CD secrets