![Wanted: Suspects for Homicide in the 2nd District [VIDEO]](https://thephillypi.com/wp-content/uploads/2026/06/Wanted-Suspects-for-Homicide-in-the-2nd-District-VIDEO-330x220.png "Wanted: Suspects for Homicide in the 2nd District [VIDEO]")
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2026-22719 (CVSS score of 8.1) Broadcom VMware Aria Operations Command Injection Vulnerability
- CVE-2026-21385 (CVSS score of 7.8) Qualcomm Multiple Chipsets Memory Corruption Vulnerability
In February, Broadcom released security updates to address multiple vulnerabilities affecting VMware Aria Operations, including CVE-2026-22719.
VMware Aria Operations is an IT operations management platform that helps organizations monitor and optimize virtual, cloud, and hybrid environments. It provides performance monitoring, capacity planning, automated alerting, and cost analysis, giving IT teams greater visibility and control over infrastructure to ensure efficiency, reliability, and compliance.
EXPLORE MORE
Phishing campaign exploits OAuth redirection to bypass defenses
Microsoft researchers warn that threat actors abuse OAuth redirects to target government…
Missing Juvenile Jayden Love-Johnson from the 15th District
The Philadelphia Police Department is seeking the public’s assistance in locating a…
Powerful twin earthquakes hit Venezuela (VIDEOS)
LIVE UPDATES Authorities have confirmed dozens of deaths and hundreds of injuries…
Missing Juvenile Destiny Obilo from the 15th District
The Philadelphia Police Department is seeking the public’s assistance in locating missing…
Army officer sentenced to 12 years in prison for secretly feeding woman abortion pills
U.S. Army Capt. Brandon Jones-Adams has been sentenced to 12 years in…
Ireland votes to abolish three-day abortion waiting period that saved thousands of lives
(LifeSiteNews) — Ireland’s Parliament voted Wednesday to abolish a mandatory three-day abortion…
The vulnerability is a command injection flaw that an unauthenticated attacker can exploit remotely.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
The second vulnerability added to the Kev catalog is CVE-2026-21385, a Qualcomm multiple chipsets memory corruption issue. The flaw is a buffer over-read in the Graphics component that could allow attackers to access sensitive memory data, underscoring ongoing risks to Android users.
Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited.
“There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by March 24, 2026.
