CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA published multiple alerts in April 2026: it added numerous actively exploited CVEs to the Known Exploited Vulnerabilities (KEV) Catalog (including remote code execution, command injection, path traversal, missing/improper authorization, and sensitive-info exposures) and issued guidance on a supply-chain compromise of the Axios npm package that injected a malicious dependency delivering multi-stage payloads and a remote-access trojan. CISA reminds organizations (and requires FCEB agencies under BOD 22-01) to prioritize timely remediation, patching, dependency pinning, credential rotation,,