CISA Adds Two Known Exploited Vulnerabilities to Catalog

Between 6–21 May 2026, CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Newly listed CVEs cover a range of products and vendors (Microsoft, Adobe, Trend Micro Apex One, Langflow, Cisco, Palo Alto Networks, Ivanti, BerriAI, Ivanti, and others) and include vulnerability types such as buffer overflows, use‑after‑free, SQL injection, directory traversal, authentication bypass, elevation of privilege, cross-site scripting, and denial of service. CISA reiterates remediation requirements under Binding Operational Direc‑