Three actively exploited vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog: (1) CVE-2026-9198 in IBM Langflow (CVSS 9.8 critical) - allows unauthenticated remote code execution on default Langflow deployments by chaining two API endpoints to bypass login and execute code; multiple public proof-of-concept exploits exist. A related Langflow flaw CVE-2026-0770 was previously flagged for RCE with root privileges. (2) CVE-2026-18576 in N-able N-central - a high-severity authentication bypass allowing attackers to hijack administrative accounts without credentials; an initial patch was insufficient, and threat actors found a new exploitation path. An emergency hotfix was released on a Sunday. (3) CVE-2026-34486 in Apache Tomcat (CVSS 7.5 high) - stems from an incomplete fix for CVE-2026-29146 (CVSS 9.8, missing encryption of sensitive data); a Chinese-speaking threat actor attempted to exploit this in a manual campaign to plant reverse shells on nine Apache Tomcat servers, as reported by Palo Alto Networks Unit 42 on July 30. CISA has not confirmed whether any of these vulnerabilities are being used in ransomware campaigns.