CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
The report links the addition of five vulnerabilities to the CISA KEV catalog with active exploitation by the China-linked APT Flax Typhoon, indicating a state-sponsored attack campaign.
The report shows that Chinese state-sponsored APTs use purpose-built scanning and exploitation tools (MicroScan, FishHub) to target Western critical infrastructure, and that US authorities are now actively disrupting them , a sign of escalating state-level cyber operations.
The flaw resides in digital signature (DigSig) handling and requires only that a crafted file or web page be opened , behaviour that is hard to avoid in everyday PDF use.
The flaw requires user interaction (opening a crafted file or web page) and fits the recurring pattern of Acrobat RCE issues, with no active exploitation reported.
The report provides technical details on a new use-after-free vulnerability in Adobe Acrobat Reader DC; no public exploit is known.
ZDI reports an unpatched use-after-free flaw in Acrobat Reader DC's Annots report handling that can be triggered simply by opening a crafted PDF.
Exploitation merely requires opening a crafted PDF file or visiting a malicious web page, allowing code execution with the privileges of the logged-on user.
The flaw requires user interaction, so email attachments and web links remain the most likely attack vector for PDF-based attacks.
The vulnerability requires user interaction, meaning it can be exploited via crafted PDFs or web pages in the normal document workflow, making it a classic entry point for attacks on office workstations.
Exploitation strictly requires user interaction (opening a crafted document or visiting a malicious page); the advisory contains no indication of active exploitation in the wild.
This is a plain ZDI advisory with no indication of active exploitation; the attack requires a user to open a crafted DCM file.
A vulnerability in Adobe Photoshop disclosed so far only by ZDI allows code execution via crafted image files, with no indication yet of active exploitation or KEV listing.
Exploitation requires active user interaction (opening a crafted file or visiting a manipulated page), which raises the risk in creative workflows primarily via email attachments and downloads.
Exploitation requires user interaction (visiting a crafted page or opening a malicious file), making email attachments and web downloads the realistic attack vectors.
The vulnerability is a type confusion in the Dialog object of Adobe Acrobat Reader DC that enables remote code execution with user interaction; a CVSS of 7.8 indicates its high severity.
This is pure patch information with no indication of active exploitation, KEV listing, or published exploit code.
The ZDI advisory describes a use-after-free flaw in Acrobat Reader DC's annotation handling that is only triggerable through user interaction and rated low at CVSS 3.3.
The vulnerability is rated low with CVSS 3.3 and requires user interaction; no active exploitation is documented.
Beyond the plain patch information, the report only adds the assessment that the code-smuggling flaw sits just below the highest severity level, making it urgent but not classified as critical.
Since it is a zero-day, the vulnerability was already actively exploited before the patch was released, underscoring the urgency of the update.
The BSI advisory does not contain CVE IDs, CVSS scores, or exploitation details, so prioritization can only be based on vendor information.
The report does not provide CVE IDs or technical details, but merely points to multiple vulnerabilities in Microsoft Edge.
The vulnerability allows an unprivileged local user in a private network namespace to trigger a kernel panic, which can impact the availability of Linux systems.
The BSI WID reports multiple Linux kernel vulnerabilities without CVE IDs or details, making prioritization difficult.
The report updates a DoS vulnerability in GNU libc that can be exploited from adjacent networks; further CVE or patch details are missing.