CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog (late June–early July 2026) based on evidence of active exploitation. The additions include a range of web-application and infrastructure issues — unrestricted file upload of dangerous types, path traversal, improper access control/validation, authentication bypass, SSRF, deserialization, code injection, and authorization bypass — and CISA reiterates that federal agencies should prioritize rapid remediation per Binding Operational Directive (BOD) 26-04.