U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog

CISA added several critical flaws—including an Adobe ColdFusion path traversal (CVE-2026-48282), JoomShaper and Joomlack page builder upload/ACL bypasses (CVE-2026-48908, CVE-2026-56290), and a Langflow authorization bypass (CVE-2026-55255)—to its Known Exploited Vulnerabilities catalog after multiple reports of active exploitation, rapid weaponization (including web shells and remote code execution), credential theft, and observed attack infrastructure; agencies and site owners are urged to patch immediately and search for indicators of compromise.