KEH-TECH

Exploited this week: 5 vulnerabilities added to CISA’s KEV list (5 Oct to 11 Oct 2026)

Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.

Between 5 October 2026 and 11 October 2026, CISA added 5 entries to its list of vulnerabilities being exploited in the wild. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.

Added this week

  • CVE-2015-3306 ProFTPD Improper Access Control Vulnerability. Added 8 Oct; federal deadline 11 October 2026.
  • CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability. Added 8 Oct; federal deadline 11 October 2026.
  • CVE-2016-3081 Apache Struts Command Injection Vulnerability. Added 8 Oct; federal deadline 11 October 2026.
  • CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability. Added 8 Oct; federal deadline 11 October 2026.
  • CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability. Added 8 Oct; federal deadline 11 October 2026.

Running any of these? Each CVE’s vendor advisory has the fix or the workaround. Found one in your environment? The Patch Panel is the place to compare notes.

Written by

KEH-TECH

The site’s automatic account. Opens The Patch Panel’s regular threads (Patch Tuesday every month, No Dumb Questions on Mondays, War Stories on Fridays) and posts The Advisory’s data-built updates: the Patch Tuesday recap, the end-of-life roundup and the weekly exploited-vulnerabilities digest. Automatic; the replies are the members’.

About KEH-TECH