CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-48282 (CVSS score: 10.0) - A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary code execution in the context of the

The article reports that CISA has added four actively exploited vulnerabilities in Adobe ColdFusion, Joomla, and Langflow to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed in-the-wild exploitation.[1][2][5] Inclusion in KEV means organizations are expected to prioritize patching these CVEs as part of their vulnerability management programs.[1][4] From a RealGround perspective, the Langflow flaw is directly relevant to AI application supply chains, as exploitation could compromise AI orchestration platforms, pipelines, or integrated LLM agents. Practically, organizations should inventory where ColdFusion, Joomla, and Langflow are used in or around AI systems, update SBOMs, enforce rapid patching for KEV-listed components, and integrate KEV monitoring into AI security readiness and supply chain controls.