CISA's list that day
8 October 2026
On CISA added 5 vulnerabilities to its list of exploited vulnerabilities, in ProFTPD, ISC BIND, Apache Struts and 2 other products. US federal agencies must fix them by .
Added that day
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2015-3306Improper Access Control | ProFTPD ProFTPD | Patch nowForensic triage required by CISA; listed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.99 | ||
| CVE-2015-5477Data Processing Errors | ISC BIND | Patch nowListed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.99 | ||
| CVE-2016-3081Command Injection | Apache Struts | Patch nowForensic triage required by CISA; listed in the last 14 days; Metasploit module; verified Exploit-DB entry | 0.96 | ||
| CVE-2021-3199Server Path Traversal | ONLYOFFICE Docs | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.19 | ||
| CVE-2023-22894Cleartext Storage of Sensitive Information | Strapi Strapi | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.04 |
Other changes that day
- CVE-2022-0995 Linux KernelDeadline moved from 9 September 2026 to 29 August 2026. Forensic triage: No to Yes.
- CVE-2026-86950 Apple Multiple ProductsDeadline moved from 2 October 2026 to 13 October 2026. Forensic triage: Yes to No.