Two exploited TrueConf Server flaws land on CISA's KEV list as Head Mare is caught delivering a poisoned installer.