KEV NEW Cisco
100 FIRESTARTER Backdoor
FIRESTARTER backdoor provides persistent access on Cisco ASA/FTD devices, enabling long-term espionage and lateral movement.
Critical
CVSS
9.9
EPSS
44%
Archive view — this data may be outdated.
CTI status
Joel Traber AG
As of:
Last pipeline run:
Status High
All threats
Sorted by KEV · Risk · EPSS KEV NEW Cisco UAT-4356
100 UAT-4356's Targeting of Cisco Firepower Devices
UAT-4356 is actively exploiting two zero-day vulnerabilities in Cisco Firepower devices to deploy the FIRESTARTER backdoor, indicating a targeted campaign against network security appliances.
Critical
CVSS
9.9
EPSS
44%
KEV NEW Microsoft
100 CISA Adds One Known Exploited Vulnerability to Catalog
This CVE is actively exploited and added to CISA's KEV catalog, requiring immediate patching for Defender for Endpoint.
Critical
CVSS
7.8
EPSS
14%
NEW GitLab
100 CVE-2026-1660
This is a patch notification with no evidence of active exploitation or specific targeting of manufacturing firms.
Medium
CVSS
6.5
EPSS
0%
NEW Microsoft
100 Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug
This alert is a standard patch notification with no evidence of active exploitation or specific targeting; it adds no new insight beyond the need to apply the out-of-band update.
Critical
CVSS
9.1
EPSS
0%
NEW GitLab
100 CVE-2025-0186
No active exploitation or campaign details provided; this is a standard patch advisory.
Medium
CVSS
6.5
EPSS
0%
NEW GitLab
100 CVE-2025-3922
This is a patch reminder for a DoS vulnerability in GitLab CE/EE; no active attack campaign or sector-specific targeting is described.
Medium
CVSS
6.5
EPSS
0%
NEW GitLab
100 CVE-2025-6016
This is a patch notification for a DoS vulnerability in GitLab CE/EE; no active exploitation or campaign details are provided.
Medium
CVSS
6.5
EPSS
0%
NEW GitLab
100 CVE-2026-5262
This vulnerability allows unauthenticated attackers to access tokens in the Storybook environment, which could lead to further compromise of GitLab repositories and CI/CD pipelines.
High
CVSS
8.0
EPSS
0%
NEW GitLab
100 CVE-2026-4922
This is a patch advisory with no evidence of active exploitation or specific attack campaigns beyond the CVE details.
High
CVSS
8.1
EPSS
0%
NEW GitLab
100 CVE-2026-5816
This is a patch reminder for a GitLab XSS vulnerability with no evidence of active exploitation or specific threat actor involvement.
High
CVSS
8.0
EPSS
0%
NEW GitLab
84 CVE-2026-6515
This is a patch reminder with no evidence of active exploitation or specific TTPs beyond the advisory.
Medium
CVSS
5.4
EPSS
0%
NEW Siemens
72 Siemens Industrial Edge Management
This CVE affects Siemens Industrial Edge Management, a platform used to manage edge devices in industrial environments, which could allow an attacker to compromise industrial operations.
Low
CVSS
3.1
EPSS
0%
NEW GitLab
67 CVE-2026-5377
This is a patch reminder for a GitLab vulnerability that could expose confidential issue titles in public projects, but no active exploitation or specific campaign is mentioned.
Medium
CVSS
4.3
EPSS
0%
NEW GitLab
55 CVE-2026-3254
This is a patch reminder; no active exploitation or campaign details are provided beyond the CVE description.
Low
CVSS
3.5
EPSS
0%
NEW Siemens
48 Siemens TPM 2.0
This vulnerability affects the TPM 2.0 firmware in Siemens SIMATIC industrial PCs, potentially allowing attackers to compromise hardware security modules in manufacturing environments.
Low
CVSS
3.1
EPSS
0%
NEW Siemens
48 Siemens SINEC NMS
This vulnerability in Siemens industrial network management software could allow remote code execution or denial of service in OT environments.
Low
CVSS
3.1
EPSS
0%
NEW Siemens
48 Siemens SINEC NMS
This CVE affects Siemens industrial network management software, potentially impacting OT network visibility and control in manufacturing environments.
Low
CVSS
3.1
EPSS
0%
NEW Siemens
48 Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary
This CVE affects Siemens industrial access management, potentially allowing unauthorized access to critical manufacturing infrastructure.
Low
CVSS
3.1
EPSS
0%
NEW Siemens
48 Siemens Analytics Toolkit
This CVE affects Siemens Analytics Toolkit, which may be used in conjunction with S7 PLCs in the company's manufacturing environment.
Low
CVSS
3.1
EPSS
0%
NEW GitLab
42 CVE-2025-9957
This is a patch advisory with no evidence of active exploitation or specific attack campaigns beyond the CVE details.
Low
CVSS
2.7
EPSS
0%
NEW Ieee
40 Siemens SCALANCE
Multiple CVEs in Siemens SCALANCE devices could allow attackers to compromise industrial network segments, potentially impacting Siemens S7 PLC operations.
Low
CVSS
3.1
EPSS
8%
NEW Sqlite
40 Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)
This CVE affects Siemens RUGGEDCOM CROSSBOW Station Access Controller, which could be used to compromise industrial control systems in manufacturing environments.
Low
CVSS
3.1
EPSS
1%
NEW Microsoft
23 ZDI-26-294: (0Day) Microsoft Windows library-ms NTLM Response Information Disclosure Vulnerability
This is a zero-day vulnerability in Windows library-ms that leaks NTLM responses, enabling credential relay attacks against Active Directory.
Low
NEW Microsoft
23 ZDI-26-293: (0Day) Microsoft Office URI Handler NTLM Response Information Disclosure Vulnerability
This is an unpatched 0day vulnerability that could allow attackers to capture NTLM hashes for relay attacks against the company's Active Directory.
Low
NEW Microsoft
23 CISA orders feds to patch BlueHammer flaw exploited as zero-day
This alert goes beyond a patch reminder by confirming active exploitation of the BlueHammer flaw in zero-day attacks, with CISA mandating federal patching, indicating a real and ongoing threat.
Low
NEW Microsoft
23 Phishing and MFA exploitation: Targeting the keys to the kingdom
Describes TTPs for bypassing MFA to compromise cloud and on-prem identity systems, which are critical for Joel Traber AG's hybrid AD/Entra ID setup.
Low
NEW Microsoft
0 Attacken laufen bereits: Rund 1.300 Sharepoint-Instanzen sind angreifbar
The alert confirms active exploitation of the SharePoint vulnerability beyond just a patch advisory, with approximately 1,300 instances already under attack.
Low
NEW Microsoft
0 Zero-Day-Lücken: Angriffe auf Windows-Systeme beobachtet
Reports active exploitation of Windows zero-days beyond mere patch advisories, indicating immediate risk to the company's Windows servers.
Low
NEW UNC6692
0 Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Describes a novel custom malware suite deployed via social engineering, with detailed TTPs that can be used to enhance detection rules for Windows and Active Directory environments.
Low
NEW
0 Defending Against China-Nexus Covert Networks of Compromised Devices
Provides TTPs and defensive measures against China-nexus covert device networks, which could target Joel Traber AG's OT/IT convergence and supply chain.
Low
NEW
0 Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained
Provides detailed TTPs and IOCs for Kyber ransomware targeting both Windows and ESXi environments, enabling proactive defense for Joel Traber AG's critical infrastructure.
Low