NEW A2
99 CVE-2026-58525
This is a standard NVD patch notice without active campaign or in-the-wild exploitation details; likely already covered by BSI/CISA advisories.
Critical
CVSS
8.2
EPSS
0%
Archive view — this data may be outdated.
CTI status
Joel Traber AG
As of:
Last pipeline run:
Status High
All threats
Sorted by KEV · Risk · EPSSAdmiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
NEW Russian state-sponsored threat actors C3
98 Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
Russian state-sponsored threat actors have already compromised Ubiquiti Edge OS routers into botnets for malware traffic proxying; three of the now-patched UniFi OS vulnerabilities have been flagged by CISA as actively exploited.
Critical
CVSS
10.0
EPSS
1%
NEW C3
97 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
GhostLock is a 15-year-old Linux kernel flaw now publicly disclosed with working exploit code offering 97% reliability for local privilege escalation and container escape.
Critical
CVSS
7.8
EPSS
0%
NEW A2
88 CVE-2026-60104: Bitwarden Server Authentication Request Vulnerability Allows Account Takeover
The vulnerability allows low-privileged organization members to impersonate other users and steal their vault keys, enabling complete account takeover and database access.
Critical
CVSS
7.3
EPSS
0%
Russia A3
85 «Security Switzerland 2026»: No all-clear for Switzerland
Swiss Federal Council warns of escalating Russian hybrid warfare against Switzerland and Europe; cyberspace and critical infrastructure identified as primary targets for espionage and attack activities.
Critical
Gamaredon C3
85 Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses
The Russian FSB is actively improving its malware delivery chains and server concealment techniques, indicating an escalated threat to European industrial networks.
Critical
C3
80 Europe Evolves Into Ransomware's Favorite Region
Ransomware-as-a-Service ecosystems are strategically shifting focus toward European organizations and their supply chains, signaling a deliberate repositioning of ransomware campaigns after a global lull.
Critical
NEW LapDogs (China-linked APT) C3
80 China-Linked APT Expands Arsenal With New 'Leash' Backdoors
A China-linked APT group is actively expanding its arsenal with new proprietary backdoor variants (LongLeash, DogLeash, JarLeash) for SOHO routers, signalling sustained investment in infrastructure compromise in the context of geopolitical tensions.
Critical
NEW UAT-7810 C3
75 China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Chinese APT UAT-7810 is actively developing custom malware (ShortLeash/LONGLEASH) to establish Operational Relay Box networks positioned as infrastructure provider for downstream threat actors,a strategic escalation pattern targeting high-value victims.
Critical
NEW Volt Typhoon C3
75 What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out
Volt Typhoon is portrayed as a persistent China-backed threat to Western critical infrastructure, signaling geopolitical cyber-warfare scenarios that indirectly threaten European supply chains and industrial operations.
Critical
NEW A2
71 CVE-2026-13129
A JavaScript-based field traversal vulnerability in PDF applications can cause application crash through invalid pointer dereference when a corrupted field form is opened.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57237
A memory-corruption flaw in PDF applications can be triggered by malicious JavaScript in form fields, leading to application crashes; remote code execution potential is unclear from the advisory.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57238
The vulnerability causes DoS through invalid object access after JavaScript deletion of form fields in PDF documents; no remote code execution.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57245
The vulnerability enables a heap corruption condition through improper validation of PDF annotation relationships, potentially leading to crashes or code execution.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57250
A flaw in PDF applications enables crash-through-service via malformed JavaScript form fields without validation checks.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57252
The vulnerability enables PDF application crashes through manipulated JavaScript code during page deletion and annotation removal, with no remote code execution or data loss documented.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57256
A validation failure in PDF form objects during JavaScript execution leads to invalid pointer access and application crash, potentially exploitable for denial-of-service.
High
CVSS
7.8
EPSS
0%
NEW C3
70 Ubiquiti warns of new max severity UniFi OS vulnerability
A maximum-severity vulnerability in Ubiquiti UniFi OS requires immediate attention as this component is central to network management and segmentation.
Critical
NEW A2
68 CVE-2026-57239
The vulnerability allows local users to escalate privileges to NT AUTHORITY\SYSTEM level via user-controllable executable files; however, the vendor, PoC status, and active exploitation details remain unclear.
High
CVSS
8.2
EPSS
0%
NEW A2
55 CVE-2026-57255
Memory vulnerability in PDF rendering enables remote denial-of-service through malformed color spaces; attack vectors via email attachments or SharePoint documents are likely.
Medium
CVSS
6.1
EPSS
0%
NEW A2
53 CVE-2026-59998: OpenSSH GSSAPIStrictAcceptorCheck Bypass in Windows Active Directory
The vulnerability documents an undocumented security behavior in OpenSSH within Windows AD environments where GSSAPI strict checks fail to activate , a previously undisclosed configuration edge case with potential authentication bypass implications.
Medium
CVSS
4.8
EPSS
0%
NEW A3
47 [UPDATE] Apache log4j: Vulnerability Enables Code Execution
BSI warning on log4j vulnerability underscores persistent risk posed by ubiquitous component in European production environments.
Critical
B3
20 Introduction to COM usage by Windows threats
Researchers systematically document how malware abuses COM interfaces for lateral movement, persistence, and Windows automation, with Qakbot presented as a case study and reverse-engineering tools discussed.
High
NEW A3
20 [UPDATE] OpenSSH: Multiple Vulnerabilities
The BSI advisory covers multiple OpenSSH vulnerabilities without naming CVE numbers or specific version details,a typical aggregated advisory lacking clarity on exploit status.
High
A3
20 Google Chrome: Multiple Vulnerabilities Allow Unspecified Attack
BSI warns of multiple Chrome vulnerabilities without published details; this suggests embargoed or yet-to-be-disclosed security flaws that may be patched imminently.
High
NEW C3
20 Entra passkey enrollment vishing targets Microsoft 365 users
Attackers use social engineering tactics to trick users into registering passkeys in Entra ID, thereby bypassing multifactor authentication.
High
NEW B3
20 Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Unattributed active campaign since April 2026 uses deceptive photo archives as entry point for multi-stage intrusion with persistent Node.js implant and obfuscated PowerShell.
High
A3
20 Google Chrome and Microsoft Edge: Multiple Vulnerabilities
The BSI warning is a collection advisory covering multiple browser vulnerabilities without specific CVE identification; prioritizing patches requires identifying the specific CVEs affecting Chrome and Edge versions in use.
High
NEW EvilTokens C3
15 New Ghost Phishing Wave Is Breaking Traditional Email Security
EvilTokens uses AES-GCM-encrypted HTML payloads that decrypt only in the browser to bypass traditional email security inspections and conduct device-code phishing attacks against Microsoft 365 accounts.
High