As cited
Copy frozen at (site build).
vulnerabilities
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence: CVE-2021-27137 (DD-WRT buffer overflow), CVE-2026-0770 (Langflow control sphere inclusion), CVE-2026-63030 (WordPress interpretation conflict), and CVE-2026-60137 (WordPress SQL injection). Binding Operational Directive 26-04 requires federal agencies to prioritize patching KEV-listed vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt risk-based vulnerability management practices.
Why it matters: Federal agencies must remediate these four vulnerabilities on internet-facing systems immediately; all other organizations should treat KEV-listed flaws as high priority given active exploitation in the wild.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence: CVE-2021-27137 (DD-WRT buffer overflow), CVE-2026-0770 (Langflow control sphere inclusion), CVE-2026-63030 (WordPress interpretation conflict), and CVE-2026-60137 (WordPress SQL injection). Binding Operational Directive 26-04 requires federal agencies to prioritize patching KEV-listed vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt risk-based vulnerability management practices.
Why it matters: Federal agencies must remediate these four vulnerabilities on internet-facing systems immediately; all other organizations should treat KEV-listed flaws as high priority given active exploitation in the wild.
- Source published
- First seen by Cybersecurity Tracker