CISA Adds One Known Exploited Vulnerability to Catalog

CISA published multiple KEV Catalog additions and an alert on supply-chain compromises. Over late May–early June 2026 CISA added several actively exploited CVEs to its Known Exploited Vulnerabilities (KEV) Catalog and reminded organizations to remediate per BOD 22-01. Newly listed CVEs include vulnerabilities such as deserialization of untrusted data, authentication bypass, integer overflow, SQL injection, privilege escalation, and embedded malicious code. Separately, CISA reported supply-chain intrusions affecting developer ecosystems: a malicious Nx Console VS Code extension (CVE-2026-48027)