One is a zero-day that has been actively exploited.