Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 5 to 11 October 2026 (week 41)
Final report, published . It does not change.
In the week of 5 to 11 October 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was @strapi/strapi (npm) (1), followed by Apache Struts (1) and Isc BIND (1).
- Newly exploited
- 5
- Critical
- 5
- Technologies hit
- 8
Newly exploited this week
- CVE-2015-3306: ProFTPD improper access control in SITE commandscriticalExploited since Published Proftpd
- CVE-2021-3199: ONLYOFFICE Docs Server path traversal in image uploadcriticalExploited since Published ONLYOFFICE Docs Server, ONLYOFFICE Docs
- CVE-2016-3081: Apache Struts command injection in Dynamic Method InvocationcriticalCVSS 3Exploited since Published org.apache.struts:struts2-core (Maven), Apache Struts
- CVE-2015-5477: ISC BIND denial of service via TKEY queriescriticalExploited since Published Isc BIND
- CVE-2023-22894: Strapi information disclosure via private field filteringcriticalCVSS 3.1Exploited since Published @strapi/strapi (npm), Strapi
Technologies hit most
- 1.@strapi/strapi (npm)1 vulnerability
- 2.Apache Struts1 vulnerability
- 3.Isc BIND1 vulnerability
- 4.ONLYOFFICE Docs1 vulnerability
- 5.ONLYOFFICE Docs Server1 vulnerability
- 6.org.apache.struts:struts2-core (Maven)1 vulnerability
- 7.Proftpd1 vulnerability
- 8.Strapi1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-10-05.json, and this page as text at https://junglewise.ai/threats/exploited/2026-10-05.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 5 to 11 October 2026 (week 41)", https://junglewise.ai/threats/exploited/2026-10-05, 13 October 2026.