Mover #1 · KEV-confirmed exploitation
ISC BIND 9
CriticalConfirmedVerified
Weakness: CWE-19; CWE-617 Reachable Assertion
What changed
Added to CISA KEV on October 8, with a public PoC cataloged (ExploitDB). The signal crossed into Confirmed.
Why it matters
A ten-year-old BIND flaw, now government-confirmed as exploited and corroborated by ENISA EUVD. A reachable assertion lets a single crafted query crash the resolver. Confirmed at critical severity. No waiting for further evidence.
Mover #2 · KEV-confirmed exploitation
ONLYOFFICE
CriticalConfirmedVerified
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
What changed
Added to CISA KEV on October 8; EPSS probability climbed to 0.15. The signal crossed into Confirmed.
Why it matters
A directory-traversal remote code execution in the ONLYOFFICE /upload path, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. No waiting for further evidence.
Mover #3 · KEV-confirmed exploitation
Strapi
CriticalConfirmedVerified
Weakness: CWE-312 Cleartext Storage of Sensitive Information
What changed
Added to CISA KEV on October 8. EPSS eased this week, but government confirmation governs the verdict.
Why it matters
Cleartext storage of sensitive information in Strapi, now government-confirmed as exploited. A falling EPSS score does not undo a KEV listing: treat this as Confirmed at critical severity.
Mover #4 · Newly weaponized
Langflow (eval injection RCE)
HighActiveHigh
Weakness: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
What changed
An unauthenticated Metasploit module landed (langflow_unauth_rce_cve_2026_0769).
Why it matters
An unauthenticated eval-injection remote code execution in Langflow, now weaponized with a public Metasploit module. Active and escalating at high severity. Review against your inventory.
Mover #5 · Newly weaponized
snapd (Linux local privilege escalation)
HighActiveHigh
Weakness: CWE-268 Privilege Chaining
What changed
A public PoC landed (ExploitDB), four days after disclosure.
Why it matters
A local privilege escalation to root in snapd on Linux, with a public proof of concept four days after disclosure. Active and escalating at high severity. Review against your inventory.
Mover #6 · Newly weaponized
IBM Langflow OSS
HighActiveHigh
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
What changed
A public PoC landed (ExploitDB) and a Metasploit module followed.
Why it matters
A code-injection remote code execution in IBM Langflow OSS, now with both a public PoC and a Metasploit module. Active and escalating at high severity. Review against your inventory.
Mover #7 · Confirmed, escalating fast
Cisco Secure Email (AsyncOS)
CriticalConfirmedVerified
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
What changed
EPSS probability jumped from 0.02 to 0.28 and keeps climbing, twenty-nine days in.
Why it matters
A SQL injection in Cisco AsyncOS email parsing, confirmed exploited and still escalating at high velocity nearly a month on. Treat as immediate.