CTI status
As of:
Last pipeline run:
Attackers are actively exploiting CVE-2026-0257 in PAN-OS just four days after public disclosure, indicating targeted attacks on firewall products in critical enterprise networks.
Threat actors are actively exploiting the vulnerability; the Centre for Cybersecurity Belgium warns of ongoing exploitation, although Microsoft has not yet confirmed active abuse in the wild.
The vulnerability requires an authorized user account and enables network-based code execution, not unauthenticated remote exploitation.
A state-sponsored Chinese campaign is deliberately targeting European and Taiwanese government and technology institutions, signaling heightened espionage activity against Western targets in critical sectors.
APT group TeamPCP compromised Checkmarx KICS via Docker Hub repository poisoning to steal Kubernetes secrets , demonstrates multi-stage supply-chain attacks on container infrastructure as an established threat pattern.
Active exploitation of a critical Netlogon RCE in Windows servers requires immediate patching, as the vulnerability is already being weaponized in attacks.
The vulnerability is already actively exploited in the wild, even though the public PoC only demonstrates a crash , code execution is possible according to Microsoft and CVSS 9.8 warrants immediate action.
A memory-safety bug (double-free) in the Windows IKEv2 service enables unauthenticated remote attackers to achieve code execution by sending specially crafted packets.
An authentication bypass vulnerability in Palo Alto PAN-OS GlobalProtect VPN already being exploited in two attack waves since mid-May represents an immediate VPN security threat.
A systemic design flaw in Node.js module resolution on Windows enables privilege escalation through local filesystem manipulation, yet remains unpatched by both Discord and Node.js maintainers.
SmartApeSG ClickFix campaign employs multi-stage infection chains: unidentified RAT delivers NetSupport Manager RAT with C2 communication over TCP 443 and daily-changing indicators.
BSI advisory on Linux Kernel vulnerability requiring physical access as prerequisite; unclear if CVE number or PoC is publicly available.
BSI warning for multiple critical vulnerabilities in widely-deployed browsers without specific CVE identifiers or PoC status , requires immediate patch-deployment planning.
Publicly available proof-of-concept code for a 19-year-old kernel vulnerability enables immediate practical exploitation and requires rapid patch verification in Ubuntu systems.
A deprecated but still-signed driver from a product discontinued in 2013 enables attackers with local access to perform privileged kernel operations and credential theft via BYOVD techniques.
BSI alerts to multiple vulnerabilities in both leading browsers without specific CVE numbers; immediate patch management and update prioritization required.
BSI alert on multiple unspecified Edge vulnerabilities without specific CVE numbers or exploit status; likely a patch roundup or generic advisory.