Two Windows vulnerabilities, one a 0-day, are under active exploitation