Covering Mon Oct 05 2026 00:00 UTC – Sun Oct 11 2026 23:59 UTC
9 newly exploited vulnerabilities discovered.
1. New Vulnerabilities Linked to Ransomware
No findings in this category this week.
2. Known Vulnerabilities with New Ransomware Indicators
No findings in this category this week.
3. Critical Zero-day Vulnerabilities
No findings in this category this week.
4. New Actively Exploited Vulnerabilities
CVE-2026-102255 affects SonicWall SMA1000 Series Appliances and can allow Server-Side Request Forgery (SSRF).
Scores: CVSS v3.1 10.0, EPSS 0.00477.
Source: https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
Advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
CVE-2015-3306 affects ProFTPD ProFTPD and can allow Arbitrary File Read/Write.
Scores: CVSS v3.1 10.0, EPSS 0.99497.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Advisory: http://www.proftpd.org/
CVE-2021-3199 affects ONLYOFFICE Docs and can allow Path Traversal leading to Remote Code Execution.
Scores: CVSS v3.1 9.8, EPSS 0.19352.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Advisory: https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
CVE-2026-105134 affects Ahsay AhsayCBS and can allow Command Injection leading to Remote Code Execution.
Scores: CVSS v4 9.3, EPSS 0.01843.
Source: https://www.huntress.com/blog/ahsaycbs-flaws-exploit
Advisory: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
CVE-2026-21589 affects Atlassian Data Center products (Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye) and can allow Arbitrary File Access.
Scores: CVSS v4 9.3, EPSS 0.01773.
Source: https://bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release
Advisory: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
CVE-2016-3081 affects Apache Struts and can allow Command Injection leading to Remote Code Execution.
Scores: CVSS v3.1 8.1, EPSS 0.96052.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Advisory: https://cwiki.apache.org/confluence/display/WW/S2-032
CVE-2015-5477 affects ISC BIND and can allow Denial of Service.
Scores: CVSS v3.1 7.5, EPSS 0.99409.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Advisory: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272
CVE-2026-105133 affects Ahsay AhsayCBS and can allow Improper Authentication.
Scores: CVSS v4 5.5, EPSS 0.00383.
Source: https://www.huntress.com/blog/ahsaycbs-flaws-exploit
Advisory: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
CVE-2023-22894 affects Strapi Strapi and can allow Information Disclosure.
Scores: CVSS v3.1 4.9, EPSS 0.03609.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Advisory: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
Summary for the vulnerability management teams:
CVE-2026-102255, CVE-2015-3306, CVE-2021-3199, CVE-2026-105134, CVE-2026-21589, CVE-2016-3081, CVE-2015-5477, CVE-2026-105133, CVE-2023-22894
Sourced from CISA KEV, Five Eyes cybersecurity agencies, additional national and university CERTs, the NVD/CVE List, EPSS, and more than 65 other reputable external sources.
Full archive: https://signals.mostexploited.com/weekly/2026-w41/
Vulnerability intelligence focused on exploitable vulnerabilities.