CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA issued multiple KEV (Known Exploited Vulnerabilities) updates in mid–late April 2026, adding a range of actively exploited vulnerabilities (path traversal, missing/incorrect authorization, improper authentication, command injection, RCE, and info exposure) to the catalog and publishing a separate supply‑chain alert for a malicious npm package affecting axios@1.14.1 and axios@0.30.4 (plain-crypto-js@4.2.1 delivering multi-stage payloads/RAT). CISA reiterates BOD 22‑01 remediation requirements and urges all organizations to prioritize timely patching, dependency pinning, credential rotation