CloudFlare's Cloudbleed seems like a big deal, with thousands of websites compromised. CNN on February 24, 2017 mentions that it "doesn't appear anyone has exploited it yet." Was CNN right? And a few days later, still no known cases of hacks based on Cloudbleed?
This is an active threat that Google is actively removing leaked information from their search engine. Although there has been no known exploit from this leaked information, it was still available via search which is hard to track what users/bots reading this data is doing with it.
"The bug may have been active since September 2016, but researchers say it was definitely from February 13 until it was discovered on February 18. Of the leaked data, researchers said they found private messages from dating sites, full messages from chat services, online password data, frames from adult video sites and hotel booking details."