CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild, The Hacker News reports. The flaws are CVE-2026-110447 (CVSS 9.2) in Collabora Online’s Built-in CODE Server and a SQL injection flaw in Arista’s VeloCloud Orchestrator.