CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-04-28T19:24:19Z•72bd458e012cad4b67592f456e05ce624124ab936da559b60c1094feb64fd374
AxiosBOD 22-01CISAKEV CatalogKnown-Exploited-Vulnerabilitiescommand-injectioncredential-rotationexposure-of-sensitive-informationimproper-authenticationimproper-input-validationinsufficient-access-controlnpmpath-traversalplain-crypto-jsremote-access-trojansupply-chainvulnerability-management
What happened
CISA published multiple KEV Catalog updates in April 2026 adding 17 CVEs across several alerts and released an alert for a supply-chain compromise of the Axios npm package. The KEV additions cover a range of issues (path traversal, missing/incorrect authentication/authorization, command injection, RCE, exposure of sensitive information, improper input validation, and storage of recoverable passwords) and are being tracked under BOD 22-01. Separately, the Axios npm compromise (axios@1.14.1 and axios@0.30.4) injected a malicious dependency (plain-crypto-js@4.2.1) that downloads multi-stage back‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 72bd458e012cad4b67592f456e05ce624124ab936da559b60c1094feb64fd374
- Enrichment time
- 2026-04-28T19:24:19Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.