Among them are two actively exploited bugs, allegedly used by state-sponsored actors.