Secuno
ENNL
Book demo
Weekly digest

Patch this first.

Hundreds of critical CVEs are published every week. Every Monday we send the five that are most likely to hurt you, in plain language, with what to do about each.

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

How we rank

Ranked on exploitation, not on scary numbers.

01Exploited first. Anything CISA added to its Known Exploited Vulnerabilities list this week goes to the top. Confirmed attacks beat theoretical severity.
02Then likelihood. EPSS estimates the chance a CVE is exploited in the next 30 days. It separates the noisy 9.8s from the ones attackers actually use.
03Then severity. CVSS breaks ties. No vendor gets more than two slots, so one patch day cannot crowd out everything else.
Latest issue · week of 2026-10-11

Last week's five.

1 · CVE-2015-3306 · CVSS 10.0 · KEV

ProFTPD lets attackers gain more rights than they should have

  • Actively exploited: CISA added it to its Known Exploited Vulnerabilities list on 8 October.
  • 99% chance of exploitation in the next 30 days (EPSS), higher than 100% of all CVEs.

What to do: Update ProFTPD to the fixed version, or apply the vendor's mitigation if no update is available yet. CISA's deadline for US federal agencies is 11 October. Details →

2 · CVE-2015-5477 · CVSS 7.5 · KEV

ISC BIND can be used to knock the service offline

  • Actively exploited: CISA added it to its Known Exploited Vulnerabilities list on 8 October.
  • 99% chance of exploitation in the next 30 days (EPSS), higher than 100% of all CVEs.

What to do: Update ISC BIND to the fixed version, or apply the vendor's mitigation if no update is available yet. CISA's deadline for US federal agencies is 11 October. Details →

3 · CVE-2016-3081 · CVSS 8.1 · KEV

Apache Struts lets attackers run their own code

  • Actively exploited: CISA added it to its Known Exploited Vulnerabilities list on 8 October.
  • 96% chance of exploitation in the next 30 days (EPSS), higher than 100% of all CVEs.

What to do: Update Apache Struts to the fixed version, or apply the vendor's mitigation if no update is available yet. CISA's deadline for US federal agencies is 11 October. Details →

4 · CVE-2021-3199 · CVSS 9.8 · KEV

ONLYOFFICE Docs lets attackers run their own code

  • Actively exploited: CISA added it to its Known Exploited Vulnerabilities list on 8 October.
  • 19% chance of exploitation in the next 30 days (EPSS), higher than 97% of all CVEs.

What to do: Update ONLYOFFICE Docs to the fixed version, or apply the vendor's mitigation if no update is available yet. CISA's deadline for US federal agencies is 11 October. Details →

5 · CVE-2023-22894 · CVSS 4.9 · KEV

Strapi lets attackers run their own code

  • Actively exploited: CISA added it to its Known Exploited Vulnerabilities list on 8 October.
  • Public exploit code is referenced.

What to do: Update Strapi to the fixed version, or apply the vendor's mitigation if no update is available yet. CISA's deadline for US federal agencies is 11 October. Details →

In your environment

Know which of these you actually run.

The digest tells you what matters this week. Secuno tells you where it is: CVEs correlated against installed software on every device, for every client.

Book a demo Look up a CVE