# Newly exploited vulnerabilities: week of 5 to 11 October 2026 (week 41)

Source: https://junglewise.ai/threats/exploited/2026-10-05  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 13 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-10-05.json  
License: CC BY 4.0 with a link back

In the week of 5 to 11 October 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was @strapi/strapi (npm) (1), followed by Apache Struts (1) and Isc BIND (1).

## Newly exploited this week

- [CVE-2015-3306: ProFTPD improper access control in SITE commands](https://junglewise.ai/threats/cve-2015-3306-proftpd-improper-access-control-vulnerability) (critical, exploited in the wild, exploited since 8 Oct 2026, published 8 Oct 2026)
- [CVE-2021-3199: ONLYOFFICE Docs Server path traversal in image upload](https://junglewise.ai/threats/cve-2021-3199-onlyoffice-docs-server-path-traversal-vulnerability) (critical, exploited in the wild, exploited since 8 Oct 2026, published 8 Oct 2026)
- [CVE-2016-3081: Apache Struts command injection in Dynamic Method Invocation](https://junglewise.ai/threats/cve-2016-3081-apache-struts-rce-vulnerability) (critical, exploited in the wild, CVSS 3, exploited since 8 Oct 2026, published 14 May 2022)
- [CVE-2015-5477: ISC BIND denial of service via TKEY queries](https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability) (critical, exploited in the wild, exploited since 8 Oct 2026, published 8 Oct 2026)
- [CVE-2023-22894: Strapi information disclosure via private field filtering](https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering) (critical, exploited in the wild, CVSS 3.1, exploited since 8 Oct 2026, published 19 Apr 2023)

## Technologies hit most

1. [@strapi/strapi (npm)](https://junglewise.ai/threats/technologies/strapi-strapi): 1 vulnerability
2. [Apache Struts](https://junglewise.ai/threats/technologies/struts): 1 vulnerability
3. [Isc BIND](https://junglewise.ai/threats/technologies/bind): 1 vulnerability
4. ONLYOFFICE Docs: 1 vulnerability
5. ONLYOFFICE Docs Server: 1 vulnerability
6. [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 1 vulnerability
7. [Proftpd](https://junglewise.ai/threats/technologies/proftpd): 1 vulnerability
8. Strapi: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 5 to 11 October 2026 (week 41)", https://junglewise.ai/threats/exploited/2026-10-05, 13 October 2026.