Comparing 23 May 2026 with the previous day 22 May 2026.
BRICKSTORM operates below the guest OS layer on the virtualization plane where EDR agents are ineffective and traditional security controls historically lag , a critical visibility gap for most organizations.
State-backed North Korean threat actor compromised axios npm packages with malicious dependency and deployed multi-platform backdoor; active supply-chain campaign relevant to software development and industrial control system environments.
Chinese APT group UNC2814 operates the GRIDTIDE campaign against telecommunications and government organizations across 42 countries with focus on international infrastructure; Google and Mandiant have initiated disruption operations.
Sophisticated APT groups like UNC6201 and UNC5807 optimize for extreme persistence by targeting edge devices (VPNs, routers) lacking EDR telemetry; exploitation occurs on average 7 days before patch availability, with custom malware deployed directly to network appliances.
Destructive cyberattacks are deliberately employed by state actors as a cost-effective weapon during conflicts; organizations should prioritize proactive hardening measures against wipers and destructive malware.
A Pwn2Own-winning vulnerability enables unauthenticated remote code execution on Canon printers across the network with high CVSS 8.8 severity.
Network-accessible Canon multifunction printers can be abused for unauthenticated remote code execution; this attack surface is frequently overlooked.
An integer-overflow vulnerability in ESXi's VMXNET3 driver enables local privilege escalation from high-privileged guest processes with CVSS 8.2; a ZDI/Pwn2Own finding indicates robust exploitation potential.
Pwn2Own demonstration of VMware ESXi exploitation reveals real privilege-escalation risks in critical virtualization infrastructure.
The vulnerability enables a protocol downgrade attack on Ubiquiti AI Pro Discovery without authentication, presenting a network entry point for network-adjacent attackers.
Local attackers with code execution can escalate to system privileges (CVSS 7.8); patches required for Windows Server 2022/2019.
A local privilege escalation vulnerability in Windows with high CVSS requires prior code execution but increases the risk of insider threats or post-compromise exploitation in the enterprise environment.
A local privilege escalation in Windows cdd with high CVSS score (8.8) requires prior code execution but poses significant risk for already-compromised systems.
A 0-day vulnerability in Microsoft Azure MCP with CVSS 9.8 enables unauthenticated remote code execution, threatening cloud identity and collaboration infrastructure across all Azure-dependent organizations.
This CVE was published in 2022; the ZDI disclosure is a post-embargo publication following Pwn2Own , patch status should be verified.
No changes in this category.
No changes in this category.
The vulnerability reveals that a previous SSH authentication fix was incomplete and remains exploitable by bypassing callback-type validation,a pattern indicating flawed security abstractions.
A privilege-escalation vulnerability in UniFi OS enables remote command execution for attackers with network access, directly compromising the central network-management infrastructure.
An access control vulnerability in UniFi OS allows network-adjacent attackers to make unauthorized system changes without requiring authentication.
Network access alone is sufficient to exploit a path-traversal vulnerability in UniFi devices for file manipulation and account compromise, without requiring authentication.
The vulnerability enables direct command execution on UniFi devices through network access by exploiting improper input validation, requiring immediate patch prioritization in Joel Traber AG's infrastructure.
The vulnerability requires existing network access and low privileges, limiting risk to internal threats or post-compromise scenarios.
Nation-state actors are operationalizing ROADtools to manipulate Entra ID tokens in targeted attacks; Microsoft has documented active APT use since 2021 against delegated administrative privileges.
Chinese nation-state APT exploits unconventional C2 channels (Discord, Microsoft Graph APIs) to infiltrate European governmental organizations, signaling elevated risk to critical infrastructure and potential supply-chain targets across the EU.
Screening Serpens deploys an evolved version of MiniJunk malware to infiltrate European targets; the threat actor employs sideloading techniques and .NET-specific code-execution methods for defense evasion.
A compromised TanStack token enabled attackers unrestricted access to Grafana's GitHub repositories because the token was not rotated , a classic sign of insufficient token hygiene in the supply chain.
Cloud Atlas employs new tools (PowerCloud, ReverseSocks) and combines legacy exploits (CVE-2018-0802) with modern evasion techniques (PowerShell archives, multi-channel C2 via Tor/SSH) to establish persistent control.
The vulnerability affects the TeamViewer DEX Platform (On-Premises) and allows low-privileged users to gain access to administrative functions,a significant risk for on-premises deployments in manufacturing environments.
Two critical Chrome vulnerabilities enable remote code execution through visiting a malicious website and require immediate update to version 148.0.7778.178/179.
BSI warns of multiple production-in-use vulnerabilities in UniFi OS Server with direct RCE potential; absence of CVE numbers suggests possible zero-days or coordinated disclosure.
BSI warning of multiple privilege escalation vulnerabilities in Microsoft Entra ID and Azure Resource Manager; these vulnerabilities enable unauthorized access to critical identity and resource management functions in hybrid cloud environments.
Kali365 is a Telegram-based phishing-as-a-service that steals OAuth tokens from Microsoft 365 environments, enabling widespread access rights; the FBI warns of active attacks in April.
BSI warns of active exploitation of a critical SharePoint vulnerability; organizations should immediately check for patches and monitor systems.
Kali365 abuses legitimate Microsoft authentication pages for persistent backdoor access; FBI warning signals active exploitation in the wild.
The BSI warns of multiple unspecified vulnerabilities in widely-used browsers without specific CVE references or documented active exploitation, suggesting a generalized patch advisory.
BSI warns of critical RCE vulnerability in SharePoint Server 2016/2019 that authenticated attackers can exploit to execute arbitrary code.
BSI warns of an authenticated privilege-escalation vulnerability in TeamViewer that allows local attackers or those with valid credentials to elevate to higher privileges.
The advisory lacks specificity regarding affected kernel versions and CVE identifiers; further details are required to assess exploitation status and patching priority for Ubuntu 24.04 LTS.
BSI warns of multiple systemd vulnerabilities with potential for denial-of-service and code execution with administrative privileges on Linux systems.
BSI advisory on multiple Linux kernel vulnerabilities without specific CVE disclosure or PoC status; concrete patch status and affected versions must be obtained from the full BSI report.
The vulnerability allows a local attacker to execute arbitrary code with elevated privileges, potentially resulting in complete system compromise and requiring immediate attention for patch management.
BSI warns of multiple Chrome vulnerabilities without detailed disclosure; patch status and exploitability still unclear.
BSI alerts to multiple unspecified vulnerabilities in Firefox/Thunderbird without CVE details; this is typically a precautionary announcement ahead of detailed security updates.
The BSI warns of multiple vulnerabilities in Synology DSM enabling various attack scenarios,from security measure bypass to data manipulation and DoS attacks.
BSI warns of multiple local vulnerabilities in Adobe Creative Cloud without specific CVE numbers; exploitation requires user interaction (malicious file) but poses risk to design and marketing teams.
Prototype pollution vulnerabilities in Adobe Acrobat and Reader enable remote code execution; BSI warns of active exploitation.
BSI warns of multiple vulnerabilities in Ubiquiti UniFi Play PowerAmp/Audio Port without specific CVE numbers or PoC details; exploitation status and affected version information are missing from the announcement.
The vulnerability requires user interaction (click on malicious URL), making the risk mitigable through security awareness and link validation, though typically not as critical as zero-click exploits.
BSI warns of multiple exploitable vulnerabilities in Firefox and Thunderbird that can be triggered by opening a malicious email or website , immediate patching required for enterprise clients.
The vulnerability requires social engineering (phishing for malicious links) for successful exploitation, which reduces attack risk for technically proficient organisations but still poses a threat to network infrastructure.
BSI warns of multiple privilege escalation vulnerabilities in Ubiquiti UniFi Network Application that enable account takeover and unauthorized privilege elevation.
The vulnerability allows attackers to abuse trusted Copilot summaries for phishing content, potentially tricking users into disclosing sensitive information.
The BSI alert on multiple RCE and privilege escalation vulnerabilities in Adobe Acrobat DC/Reader DC requires immediate patching action for all affected systems in the company.
Three critical vulnerabilities in UniFi OS are being actively exploited; Ubiquiti-based network access controls are at immediate risk.
Fox Tempest leverages compromised edge appliances (F5 firewalls) as durable enterprise footholds with limited visibility, combined with Confluence exploitation for lateral movement.
The vulnerability enables bypassing physical confirmation (User Presence) on FIDO/U2F security keys in SSH, allowing unattended authentication , critical for organizations using hardware keys to protect remote access.
OpenSSH-based remote access scenarios at Joel Traber AG may be affected by a vulnerability that bypasses key access restrictions and permits unrestricted use of forwarded keys on remote hosts.
BSI warns of multiple Linux kernel vulnerabilities causing DoS impact; specific CVE numbers and CVSS ratings are not provided in the advisory.
An authenticated remote exploitation in Synology DSM with information disclosure impact requires monitoring for available patches and access control enforcement.
BSI warns of multiple vulnerabilities in Chrome and Edge not yet publicly detailed; vendors are working on patches with details to follow.
Local code-execution vulnerability in Adobe Photoshop requiring user interaction (file opening); BSI warns of this flaw.
The BSI warns of multiple unspecified vulnerabilities in Microsoft Edge enabling information disclosure and manipulation; user interaction is required for exploitation.