The 10 vulnerabilities from the past seven days that most need attention, ranked by a fixed rule: flaws CISA confirmed as actively exploited come first (those used in ransomware at the top, then newest first), followed by the highest-scoring Critical CVEs published by NIST’s National Vulnerability Database.
| # | CVE | What it affects | Why it ranks | Date |
|---|---|---|---|---|
| 1 | CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | Actively exploited (CISA KEV) | October 8, 2026 |
| 2 | CVE-2016-3081 | Apache Struts Command Injection Vulnerability | Actively exploited (CISA KEV) | October 8, 2026 |
| 3 | CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability | Actively exploited (CISA KEV) | October 8, 2026 |
| 4 | CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability | Actively exploited (CISA KEV) | October 8, 2026 |
| 5 | CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | Actively exploited (CISA KEV) | October 8, 2026 |
| 6 | CVE-2026-108804 | A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the ar… | CVSS 10 Critical (NVD) | October 12, 2026 |
| 7 | CVE-2026-108576 | A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injectio… | CVSS 10 Critical (NVD) | October 11, 2026 |
| 8 | CVE-2026-96207 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | CVSS 10 Critical (NVD) | October 8, 2026 |
| 9 | CVE-2026-76482 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive… | CVSS 10 Critical (NVD) | October 7, 2026 |
| 10 | CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such… | CVSS 10 Critical (NVD) | October 5, 2026 |
Descriptions are quoted from CISA and NVD. Always confirm fixed versions in the vendor’s own advisory before prioritizing.