CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency added four actively exploited security flaws to its Known Exploited Vulnerabilities catalog on July 8, 2026. CISA announced the additions after receiving evidence of active exploitation in the wild. The flaws include CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion with CVSS score of 10.0 that could lead to arbitrary code execution in the context of the current user; CVE-2026-56290, an improper access control vulnerability in Joomlack Page Builder with CVSS score of 10.0 that could allow for remote code execution via unauthenticated arbitrary file upload; CVE-2026-55255, an authorization bypass through a user-controlled key vulnerability in Langflow with CVSS score of 6.1 that could allow an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request; and CVE-2026-48908, an unrestricted upload of a file with a dangerous type vulnerability in JoomShaper SP Page Builder with CVSS score of 10.0.