CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
The vulnerability enables remote code execution through unsafe deserialization and is already listed on the CISA KEV catalog, indicating active exploitation; BOD 26-04 compliance is mandated.
The patch release includes 56 critical vulnerabilities in Windows Server and Office products, including remote code execution flaws in Dynamics NAV and a BitLocker bypass with public exploit.
This is a monthly patch summary with no indication of active exploitation or geopolitical significance; purely routine vulnerability management information.
CVE-2026-50522 is being actively exploited in attack campaigns to steal machine keys and establish persistent access; this is the fourth SharePoint vulnerability exploited in this month.
The vulnerability allows malicious websites to access WhatsApp Web data through inadequate access controls in the Adobe Acrobat browser extension,an attack that can occur silently and affects hundreds of millions of users.
A vulnerability already patched by Oracle is catalogued here as a new CVE with a future date (2026), with no evidence of active exploitation or novel attack patterns.
First joint UK-EU sanctions against Russian cyber and disinformation actors underscore escalation of state-APT activity in Europe and growing geopolitical dimension of cyber threats to DACH regions.
Russian state-sponsored actors are conducting targeted attacks against routers to gain access to critical infrastructure and industrial networks , a direct threat to European manufacturing facilities operating network perimeter devices.
Kaspersky research shows that attackers continue to exploit years-old vulnerabilities such as EternalBlue (MS17-010 from 2017) to compromise networks, underscoring that patch-management gaps remain a strategic risk for enterprise infrastructure.
Iranian threat actors are conducting escalating attacks against operational technology systems, particularly targeting HMI and SCADA displays in manufacturing facilities,a direct scenario for European manufacturers in geopolitically sensitive sectors.
The vulnerability enables unauthenticated network-based DoS attacks but impacts only availability (no data compromise) and is a standard Oracle patching cycle release.
A locally triggered privilege escalation in snap-confine allows unprivileged local users to obtain root access on default desktop installations.
Rapid7 disclosed a chained exploit combining authentication bypass (CVE-2026-55040) with a separate RCE vulnerability; unauthenticated attackers can achieve remote code execution on SharePoint servers , patching the authentication bypass breaks the exploit chain.
OpenSSH vulnerabilities enable local code execution and pose immediate risks to Ubuntu systems used for remote administration.
Multiple critical vulnerabilities in Firefox, Firefox ESR, and Thunderbird enable arbitrary code execution and sandbox escape; BSI advisory without specific CVE numbers indicates bundled security updates.
AI-aided vulnerability discovery drives record patch numbers; meanwhile, tests show that automated exploit generation is rendering Microsoft's exploitability rating obsolete.
48 of the 57 critical vulnerabilities are RCE flaws, two of which are already being exploited in the wild; Snort detection rules are available.
BSI advisory confirms critical and zero-day vulnerabilities in SharePoint without further technical details; patch status and affected versions should be immediately verified via Microsoft channels.
The vulnerability enables unauthorized VPN access without authentication and is already being actively exploited in the field , an immediate risk for manufacturing networks and critical infrastructure.
The BSI warning covers multiple critical UniFi vulnerabilities without specifying CVE numbers or proof-of-concept status , organizations should immediately monitor Ubiquiti security advisories for affected versions and patches.
ARToken reveals a sophisticated PhaaS infrastructure with 80+ API endpoints for PRT persistence, device code phishing, and SharePoint exfiltration , an actively exploited ecosystem for large-scale compromise of Microsoft 365 environments.
The vulnerability enables a sandbox escape following prior compromise of the renderer process, requiring chaining with browser RCE exploits for complete system takeover.
After renderer process compromise, attackers can exploit crafted HTML to exfiltrate cross-origin data, undermining browser content isolation.
A heap buffer overflow in the V8 engine enables remote code execution within the Chrome sandbox; patching to version 150.0.7871.182 or later is required.
This is an isolated and timely security vulnerability with no signs of active exploitation in the wild, but requires immediate updating to Chrome 150.0.7871.182 or later.
Local privilege escalation in Veeam Updater allows unauthenticated local users root-level access to the appliance operating system , critical for backup infrastructure with direct access.
The campaign leverages 7,600 legitimate GitHub repositories as a distribution channel for infostealers and downloader malware, affecting both developers and end-users while undermining trust in open-source platforms.
BSI warns of multiple Edge vulnerabilities enabling code execution and privilege escalation, requiring user interaction for exploitation.
BSI warns of multiple Chrome vulnerabilities without detailed CVE disclosure; details are not yet public, but patching should be prioritized as code execution is possible.
BSI alerts to multiple vulnerabilities in UniFi OS Server without specific CVE identifiers; concrete patch status and update availability are currently undocumented.
A local code execution vulnerability in Adobe Acrobat Reader enables full system compromise and requires immediate patching.
The vulnerability allows local attackers to gain root access to the system via the Veeam Updater component; a patch (version 12.3.0.65) is already available.
The Kratos phishing platform (also known as SneakyLog) was dismantled by German and US authorities after running approximately 15,000 phishing campaigns monthly and stealing session cookies to bypass 2FA.
BSI warning on Python RCE vulnerability enabling arbitrary code execution; relevant to all systems executing Python.
BSI has documented multiple critical vulnerabilities in Aruba AOS-CX switches that allow security bypass and arbitrary code execution , relevant to network segmentation and access control in production environments.
A local privilege escalation vulnerability in Veeam Backup & Replication requires immediate attention as it can be exploited by attackers with local system access to compromise the system.
BSI advisory on multiple Firefox vulnerabilities without specific CVE numbers; practical patches should be sourced from Mozilla release notes or security updates.
BSI advisory on multiple Chrome vulnerabilities without specific CVE numbers; exploitation may require user interaction (e.g., visiting a malicious website).
CISA warns of active exploitation of SharePoint vulnerabilities and urges hardening measures, indicating ongoing attacks in the wild.
A remote code execution vulnerability in 7-Zip affecting NTFS archive processing requires user interaction for exploitation and poses immediate risk to all installations.
The vulnerabilities remain undisclosed at publication time, indicating an active coordinated disclosure process; technical details and exploitability status remain unclear.
North Korean Kimsuky APT distributes ScreenConnect as counterfeit freeware installers (OBS Studio, DS4Windows, Glary Utilities) to gain enterprise network access; linked to AppleSeed malware and new PebbleDash-based tools.
After October, Exchange 2016 and 2019 will no longer receive security updates , organisations running these versions must evaluate migration or Extended Security Update (ESU) licensing to maintain compliance and security.
A locally exploitable privilege escalation in snapd enables unauthorized root access on Ubuntu systems without authentication.
A previously unlisted heap-overflow vulnerability in the WinRAR RAR5 parser enables remote code execution through specially crafted archives and requires user interaction.
Without specific CVE numbers, affected product versions, or indications of active exploitation, this is a generic patch announcement with no strategic added value.
Microsoft is making passkeys the default authentication method in Entra ID starting September 2026 to increase phishing resistance and reduce reliance on SMS and voice-based factors.
BSI warning on multiple Linux kernel vulnerabilities with local exploitability; specific CVE numbers not mentioned, so context unclear.
An authenticated vulnerability in Synology DSM enables information disclosure; BSI warning indicates a remediated or documented risk.
The BSI advisory warns of multiple Firefox vulnerabilities without specific CVE numbers or exploit details, suggesting a generic security notice, possibly as part of regular updates or patch roundup.
BSI warns of multiple Linux kernel vulnerabilities without specific CVE identifiers or exploitation status,detailed technical analysis is required to assess impact and urgency.