U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog

CISA added four high‑severity vulnerabilities — SolarWinds Web Help Desk deserialization RCE (CVE‑2025‑40551), GitLab SSRF (CVE‑2021‑39935), Sangoma FreePBX improper authentication (CVE‑2019‑19006), and FreePBX OS command injection (CVE‑2025‑64328) — to its Known Exploited Vulnerabilities catalog; several carry CVSS scores up to 9.8, there is evidence of active exploitation (notably SSRF activity), and federal agencies have been ordered to remediate the flaws on accelerated timelines.