Learn Russian: Я хочу знать, кто виноват.

Short-form adjectives are used to describe temporary states or someone's state in a specific situation. Here, виноват means someone is "to blame" for a specific incident, rather than being a generally guilty type of person (виноватый).

Since we don't know who is to blame, why is виноват in the masculine form?

The pronoun кто (who) grammatically acts as a masculine singular noun. Whenever you use кто as the subject, any verbs or short-form adjectives attached to it must be in the masculine singular form, even if the actual culprit turns out to be a woman or a group of people.

There is no word for "is" here. How does Russian say "is to blame"?

Russian almost always drops the verb "to be" in the present tense. Therefore, кто виноват translates literally as "who [is] guilty." You just pair the pronoun directly with the short-form adjective.

Why is there a comma before кто?

In Russian, you must use a comma to separate two clauses (parts of a sentence that each have their own action). Я хочу знать (I want to know) and кто виноват (who is to blame) are separate clauses, so a comma is strictly required.