CISA Adds Eight Known Exploited Vulnerabilities to Catalog
2026-04-20T21:24:20Z•ec2d45eaebe11e5b2698296c02e8f0ab45d3482bbab0a55d5f67afef9374849a
BOD-22-01KEVactive-exploitationaxioscisacredential-storageimproper-authenticationinformation-disclosureknown-exploited-vulnerabilitiesmalicious-dependencynpmpath-traversalplain-crypto-jsprototype-pollutionremote-access-trojansql-injectionsupply-chainvulnerability-managementxss
What happened
CISA published multiple alerts: (1) a software supply-chain compromise affecting Axios npm (malicious dependency plain-crypto-js@4.2.1 injected into axios@1.14.1 and axios@0.30.4 that downloads multi-stage payloads including a remote access trojan) with mitigation guidance (downgrade to axios@1.14.0 or @0.30.3, remove node_modules/plain-crypto-js, audit repos/CI/CD/dev machines, rotate credentials); and (2) numerous additions to the Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation. New KEV entries span authentication flaws, path traversal, XSS, improper input/use of P
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- ec2d45eaebe11e5b2698296c02e8f0ab45d3482bbab0a55d5f67afef9374849a
- Enrichment time
- 2026-04-20T21:24:20Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.