Core Lightning has not publicly disclosed which specific vulnerabilities are being exploited in the active attacks or whether any node operators have lost funds.