CISA adds two known exploited vulnerabilities to catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation:

CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability, CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability.

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.