The U.S. Cybersecurity & Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog to include three (3) security flaws: one (1) affecting Google Chrome and two (2) targeting D-Link routers. The Google Chrome vulnerability, tracked as CVE-2024-4761, involves an out-of-bounds write in the V8 JavaScript engine and is rated as highly severe, with confirmed active exploitation as of May 13, 2024. Although another related Chrome vulnerability has been exploited, it hasn’t yet been added to CISA’s catalog. For D-Link, the highlighted vulnerabilities include a ten-year old cross-site request forgery (CSRF) vulnerability in DIR-600 routers (CVE-2014-100005) and another bug in DIR-605 routers (CVE-2021-40655), with both models no longer supported by D-Link. These vulnerabilities allow attackers to hijack administrative controls or steal credentials. With their addition to the KEV, CISA mandates that all Federal Civilian Executive Branch (FCEB) agencies to patch or mitigate all affected devices by no later than June 6, 2024, to mitigate risks, emphasizing the ongoing threat from older, unpatched vulnerabilities often exploited by botnet malware.