Reported by 7 outlets
CISA adds five exploited vulnerabilities to KEV catalog
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.05 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.5 / 10 = base × recency + community
Desk analysis
CISA added five exploited vulnerabilities to its Known Exploited Vulnerabilities catalog after abuse by China-linked Flax Typhoon. The batch includes CVE-2015-3306 (CVSS 10.0, ProFTPD arbitrary file read/write via SITE CPFR/CPTO), CVE-2015-5477 (BIND TKEY handling), CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894. The event references exploitation by Flax Typhoon and links to the primary source at thehackernews.com.
Federal agencies have patch deadlines under CISA KEV rules. Watch for confirmation of which CVEs have in-the-wild implants versus PoC-level activity, and whether the same Flax Typhoon campaigns target additional sectors.
Timeline
-
original reporting
🚨 [CISA-2026:1008] CISA Adds 5 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 5d ago · October 8th, 2026
🚨 [CISA-2026:1008] CISA Adds 5 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1008
-
update from exploit-db.com
ProFTPd 1.3.5 - File Copy (EDB-ID 36742)
exploit-db.com · 4202d ago · April 13th, 2015
Exploit-DB entry 36742 documents arbitrary file read and write on ProFTPD 1.3.5 through the SITE CPFR and SITE CPTO commands, the mod_copy abuse later filed as CVE-2015-3306. The page's own published_time metadata dates it April 13, 2015, making it the earliest dated public proof-of-concept disclosure found. NVD independently scores the bug CVSS 3.1 10.0 with network vector, no privileges, and no user interaction.
-
update from web.archive.org
CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure (ISC KB AA-01272)
web.archive.org · 4095d ago · July 29th, 2015
ISC knowledge base article AA-01272 is the vendor advisory for CVE-2015-5477, stating that an error in handling TKEY queries can make named exit on a REQUIRE assertion failure in BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3. The original page now renders only through JavaScript, so its date rests on the Wayback Machine capture timestamped July 29, 2015 at 01:47 UTC, corroborated by the NVD record published the same day. CISA's KEV notes for this batch cite the archived advisory directly.
-
update from web.archive.org
Apache Struts Security Bulletin S2-032 (CVE-2016-3081)
web.archive.org · 3822d ago · April 27th, 2016
Apache security bulletin S2-032 describes CVE-2016-3081: remote code execution through the method: prefix when Dynamic Method Invocation is enabled in Struts 2.3.20 through 2.3.28, fixed in 2.3.20.3, 2.3.24.3, and 2.3.28.1. It credits reporter Nike Zheng of DBAPPSecurity and carries the on-page revision date April 27, 2016. The bulletin survives through a Wayback Machine capture because the Apache wiki page has since moved.
-
update from nvd.nist.gov
NVD record for CVE-2021-3199 (ONLYOFFICE Document Server path traversal)
nvd.nist.gov · 2086d ago · January 26th, 2021
The NVD record, published January 26, 2021, describes a path traversal via a /.. sequence in an image upload parameter of ONLYOFFICE Document Server before 5.6.3 when JWT is enabled, escalating to remote code execution, scored CVSS 3.1 9.8. The vendor's Document Server changelog entry for 5.6.3 confirms the fix line: Fix Path Traversal vulnerability via image upload params, Bug #46113.
-
update from ghostccamm.com
Multiple Critical Vulnerabilities in Strapi Versions (ghostccamm.com)
ghostccamm.com · 1276d ago · April 17th, 2023
This researcher writeup, dated April 17, 2023 on the page, documents CVE-2023-22894 among a set of Strapi flaws: the query filter lets an attacker with admin panel access filter users by sensitive columns and infer their values, including password hashes and password reset tokens with super admin rights. It also details the companion bug CVE-2023-22621, which CISA's KEV entry notes can chain with CVE-2023-22894 to reach remote code execution.
-
update from thehackernews.com
🤖 CISA added 5 flaws to its Known Exploited Vulnerabilities catalog after abuse by China-linked Flax Typhoon, incl. CVE-2015-3306 (CVSS 10.0
thehackernews.com · 4d ago · October 9th, 2026
🤖 CISA added 5 flaws to its Known Exploited Vulnerabilities catalog after abuse by China-linked Flax Typhoon, incl. CVE-2015-3306 (CVSS 10.0
via Mastodon https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html
-
update from gbhackers.com
CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
gbhackers.com · 1d ago · October 12th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2016-3081, a critical command injection vulnerability in Apache Struts, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability affects Apache Struts deployments where Dynamic Method Invocation (DMI) is enabled. Tracked as CWE-77, this flaw allows a remote attacker to […] The post CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .