CISA Adds One Known Exploited Vulnerability to Catalog

CISA published multiple KEV Catalog updates (Mar 18–25, 2026) adding several vulnerabilities with evidence of active exploitation and urging immediate remediation. Newly listed CVEs include code injection, deserialization, buffer overflow, cross-site scripting, and information-disclosure flaws across products such as Langflow, Craft CMS, Laravel Livewire, Apple products, Cisco Secure Firewall Management Center / Security Cloud Control (FMC/SCC), Microsoft SharePoint, Synacor Zimbra Collaboration Suite (ZCS), Wing FTP Server, and others. CISA also issued an alert urging hardening of endpoint‑/U