Known Exploited Vulnerabilities (KEV) catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical flaw affecting Ray to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability can potentially trigger a browser-based RCE. Ray is described as an open-source, Python-native distributed computing framework used for scaling AI and machine learning workloads.

CISA added two maximum-severity vulnerabilities in iCagenda and Balbooa Joomla extensions to its KEV catalog, citing reports of zero-day exploitation. Both flaws, rated 10.0 on the CVSS scale, are being actively exploited.

CISA added a maximum-severity vulnerability in Joomla JCE to its KEV catalog, citing active exploitation. The flaw, CVE-2026-48907 with a CVSS score of 10.0, involves improper access control allowing arbitrary PHP code execution.

CISA ordered federal agencies to prioritize vulnerability patching based on four criteria, including public exposure and automation potential. Agencies must adhere to timelines for remediation, with urgent fixes required for vulnerabilities meeting all four criteria. The directive aims to address AI-driven increases in vulnerability discovery and exploitation.

CISA added a critical remote code execution (RCE) vulnerability in Mirasvit Cache Warmer, a Magento extension, to its KEV catalog due to active exploitation. The flaw, CVE-2026-45247 with a CVSS score of 9.8, involves deserialization of untrusted data.

CISA added a critical Linux privilege escalation vulnerability (CVE-2026-31431) to its KEV catalog due to active exploitation. The flaw, with a CVSS score of 7.8, allows local attackers to gain root access on affected Linux distributions.