Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.
Below: every entry added between 5 October and 11 October 2026, copied from the catalogue and linked to its NVD record, plus what Romania's national cyber security directorate and Have I Been Pwned published in the same days. Nothing is estimated or rewritten.
The 5 actively exploited vulnerabilities added this week
| Added | Product | CVE | Known ransomware use |
|---|---|---|---|
| 8 Oct | Strapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability | CVE-2023-22894 | not known |
| 8 Oct | ONLYOFFICE Docs Server Path Traversal Vulnerability | CVE-2021-3199 | not known |
| 8 Oct | Apache Struts Command Injection Vulnerability | CVE-2016-3081 | not known |
| 8 Oct | ISC BIND Data Processing Errors Vulnerability | CVE-2015-5477 | not known |
| 8 Oct | ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability | CVE-2015-3306 | not known |
Breaches added to Have I Been Pwned
- Angel One: 6,765,054 accounts, added 7 October. Check the breach page
- Neogen: 435,963 accounts, added 9 October. Check the breach page
- CyrusOne: 373,460 accounts, added 7 October. Check the breach page
- Double Counter: 274,922 accounts, added 7 October. Check the breach page
If your team's work addresses may be in one of these, check the breach page and the password reuse question, not only the address.
How to use a list like this in an hour
- Start with what faces the internet. VPN and access gateways, firewalls, routers, mail servers and public web platforms are how many ransomware incidents start.
- Search your inventory by product name, not by memory. "We don't run that" is a claim, and the asset list is the evidence.
- Patch or apply the vendor mitigation, then confirm the version. A patch that was downloaded but not applied reads as done in a ticket and is still exploitable.
- If you cannot patch today, reduce exposure: restrict the management interface to known addresses, disable the affected feature, or put the service behind an access gateway you trust.
Where this comes from
A small collector reads official sources every hour: DNSC, CERT-EU, CERT-FR (ANSSI), CERT-Bund (BSI), the UK NCSC, CISA KEV, Have I Been Pwned and three specialist newsrooms. It copies each item exactly, with its source link, and publishes the result on one page:
https://devaland.cloud/alerte-live.html (in Romanian, with every title kept in its original language).
Nothing on that page or in this post is written by a model. A security page that paraphrases an advisory wrongly does more harm than no page at all.
Sources: CISA KEV catalogue (dateAdded 2026-10-05 to 2026-10-11), DNSC alerts, Have I Been Pwned. Generated from the sources on 2026-10-12.
Top comments (0)