CISA added two actively exploited flaws to its KEV catalog: an XXE issue in Cisco BroadWorks and a resource-transfer bug in Openwave's Webtop Media Transcoder. Malbear Labs said the Cisco flaw was used in Operation Snowball, an autonomous campaign by an unknown Chinese-speaking actor against a European telecom provider and 13 hosted firms.