CISA Flags Two High-Severity Flaws: Collabora CODE and Arista VeloCloud Targeted in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. Both flaws carry very high CVSS scores and have been observed in real-world attacks, prompting public advisories and vendor patches in September and October 2026. The vulnerabilities at a glance CVE-2026-110447 (CVSS 9.2) — An operating system command injection in Collabora Online’s Built-in CODE Server…