Skip to content

Data collected

CVEs Live

Added to CISA KEV, 5 Oct 2026 to 11 Oct 2026

5 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog in this week. Listed by risk: highest EPSS first.

Build snapshot collected · KEV catalog 2026.10.21 · EPSS of 21 Oct 2026 · not a live feed: collected once, at build time

  1. CVE-2015-3306Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    ProFTPD · ProFTPD

    ProFTPD Improper Access Control Vulnerability

    Severity

    10.0CRITICALCVSS 3.1 · CISA-ADP

    Attack probability (EPSS)

    99.5%99.9th pct

    KEV dates

    added due
  2. CVE-2015-5477Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    ISC · BIND

    ISC BIND Data Processing Errors Vulnerability

    Severity

    7.5HIGHCVSS 3.1 · CISA-ADP

    Attack probability (EPSS)

    99.4%99.9th pct

    KEV dates

    added due
  3. CVE-2016-3081Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Apache · Struts

    Apache Struts Command Injection Vulnerability

    Severity

    8.1HIGHCVSS 3.1 · CISA-ADP

    Attack probability (EPSS)

    96.1%99.9th pct

    KEV dates

    added due
  4. CVE-2021-3199Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    ONLYOFFICE · Docs

    ONLYOFFICE Docs Server Path Traversal Vulnerability

    Severity

    9.8CRITICALCVSS 3.1 · CISA-ADP

    Attack probability (EPSS)

    20.1%97th pct

    KEV dates

    added due
  5. CVE-2023-22894Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Strapi · Strapi

    Strapi Cleartext Storage of Sensitive Information Vulnerability

    Severity

    7.2HIGHCVSS 3.1 · CISA-ADP

    Attack probability (EPSS)

    3.61%89th pct

    KEV dates

    added due

All entries are in KEV, so the order is EPSS probability, then published CVSS. Scores are shown as each source published them.

The week in numbers

5 vendors had products added: ProFTPD (1), ISC (1), Apache (1), ONLYOFFICE (1), Strapi (1). CISA marks none of the 5 as known to be used in ransomware campaigns.

Due dates in this batch run from 11 Oct 2026 to 11 Oct 2026. They bind US federal civilian agencies; for everyone else they indicate how urgent CISA considers each fix.

Other weeks

Questions

How many vulnerabilities were added to CISA KEV in the week of 5 Oct 2026?

5, between 5 Oct 2026 and 11 Oct 2026, according to catalog version 2026.10.21 collected on 22 Oct 2026.

Why do additions come in batches?

CISA updates the catalog on US business days and often adds several CVEs in one notice, for example a set of vulnerabilities in the same product that are chained in an attack. Weeks with no additions also happen.

How is the week defined?

By the "dateAdded" field of each entry, grouped in ISO 8601 weeks, Monday to Sunday.

Related sections