Comparing 29 May 2026 with the previous day 28 May 2026.
CVE-2026-0265 enables authentication bypass in Palo Alto Networks firewalls with Cloud Authentication Service enabled; no public exploits available yet but practical exploitability confirmed with technical details pending disclosure.
Kimsuky has developed two variants of the httpMalice backdoor: an HTTP/HTTPS variant (v1.9) with Windows service persistence and an older Dropbox-API-based variant (v1.8), which could target European and DACH organizations.
Russian threat actor leverages generative AI (ChatGPT, Gemini) for highly personalized phishing lures , a TTP escalation that could transfer to European organizations.
This is patch information without evidence of active exploitation or specific attack campaigns; the vulnerability is documented as a standard NVD advisory.
The vulnerability enables not only code execution within the Chrome renderer but also potential sandbox escape, which could allow local system compromise.
The vulnerability requires a pre-compromised renderer process first, making it not a direct remote code execution scenario without prior compromise.
The vulnerability enables remote code execution within the Chrome sandbox via a crafted HTML page and requires immediate update to version 148.0.7778.216 or later.
A critical out-of-bounds write vulnerability in ANGLE's graphics engine enables remote code execution via plain HTML pages, accelerating browser-based attacks on employees.
This is an already-known patch notification from NVD/Chromium without evidence of active exploitation or campaigns in the wild.
A critical use-after-free vulnerability in Chrome enables arbitrary code execution via crafted HTML pages; the CVE is already classified as Critical by authoritative sources (NVD, Chromium Security) and represents standard patch routine, not an active campaign.
The vulnerability enables remote code execution via crafted PAC scripts and particularly threatens environments with managed proxy configurations or enterprise PAC files.
A critical use-after-free vulnerability in Chrome's XR module allows an attacker with renderer process access to escape the sandbox,a direct threat for browser-based attack vectors on Windows systems.
A critical use-after-free vulnerability in Skia allows an attacker with access to the renderer process (e.g. through malicious HTML) to achieve a sandbox escape.
Active supply-chain attack on npm ecosystem with targeted theft of AWS, Vault, and CI/CD secrets through typosquatting of well-known DevOps libraries.
BSI warning regarding multiple OpenSSL vulnerabilities with potential code execution and denial-of-service; update information without specific CVE details in this summary.
Rapid7 MDR observed active exploitation of this authentication bypass by multiple attackers against numerous customers; the vulnerability enables unauthenticated remote access to VPN gateways under specific configurations.
The vulnerability allows an attacker with access to the renderer process (e.g., via drive-by download or malicious website) to potentially escape the Chrome sandbox and execute system-level code.
The vulnerability enables sandbox escape following renderer process compromise, which carries higher attack potential for endpoints than routine patch management suggests.
Heap corruption vulnerability in Google's PDFium PDF renderer enables remote exploitation via crafted PDF files without user interaction in Chrome; high risk for organizations with PDF-processing workflows.
This vulnerability is already documented in the NVD (National Vulnerability Database) and requires active user interaction with specific UI gestures, which limits practical exploitation in enterprise environments.
A race condition in Chrome's WebAudio API prior to version 148.0.7778.216 enables remote code execution within the sandbox,a critical direct security issue that endangers users visiting crafted web pages.
This is a standard patch advisory with no indication of active exploitation or targeted campaigns.
This is a standard patch notification with no indication of active exploitation or campaigns , a routine Chrome security update.
An integer overflow in ANGLE's graphics engine allows an attacker to leak data across origin boundaries via a crafted HTML page, indicating browser access and secure session data as attack targets.
The vulnerability requires a complex attack chain: it necessitates a pre-compromised renderer process, significantly raising the practical attack barrier and distinguishing this from direct remote code execution scenarios.
The vulnerability allows an attacker with a malicious extension to escape the browser sandbox, potentially enabling full system compromise.
The vulnerability requires a pre-compromised renderer process; the risk for Joel Traber AG is therefore limited to scenarios where malware first gains entry to the browser.
The vulnerability enables code execution within the Chrome sandbox by manipulating the V8 engine via crafted HTML pages, which could facilitate propagation through phishing or drive-by download attacks.
The vulnerability allows an attacker with a compromised renderer process to achieve sandbox escape via crafted HTML , this is a post-compromise escalation technique, not an initial attack vector.
The vulnerability requires an already-compromised renderer process; no independent remote code execution vector from the web is described, which limits practical exploitability.
The vulnerability requires an already-compromised renderer process, reducing practical attack likelihood and representing a secondary exploitation scenario.
A renderer process exploit enables a potential sandbox escape, allowing an already-compromised browser process to potentially gain full system privileges.
This vulnerability allows an attacker with access to the renderer process to escape the sandbox, breaking the isolation between web content and the operating system and enabling full system compromise.
An out-of-bounds read vulnerability in Google's ANGLE renderer enables memory disclosure on systems with Chrome < 148.0.7778.216 without requiring additional user interaction or elevated privileges.
A use-after-free vulnerability in the ANGLE renderer enables complete sandbox escape via crafted HTML pages,critical for secure browsing environments on Windows/Linux systems.
This is a standard Chrome security update with no signs of active exploitation or geopolitical implications; the NVD notice documents the patch date without additional strategic insights.
A remote attacker can exfiltrate cross-origin data via a crafted HTML page on Chrome versions prior to 148.0.7778.216.
This is a standard NVD patch advisory with no indicators of active exploitation or targeted campaigns; however, the sandbox escape requires prior renderer-process compromise as a precondition.
This is a standard NVD patch advisory for a Chrome vulnerability with no indication of active exploitation or an ongoing campaign.
The vulnerability enables out-of-bounds memory reads through crafted HTML pages with minimal user interaction beyond visiting a malicious website.
Sandbox escape vulnerability in Chrome allows attackers to execute exploit code without browser sandbox restrictions, potentially leading to unrestricted code execution on Windows clients (including at Joel Traber).
The vulnerability enables sandbox escape following renderer process compromise, but requires prior control of the renderer process and is thus secondary to other browser exploits.
The vulnerability enables code execution within Chrome's sandbox via crafted HTML pages and affects versions prior to 148.0.7778.216; no active exploit in the wild is known.
An out-of-bounds read vulnerability in Chrome's ANGLE rendering engine enables remote attackers to execute arbitrary code via crafted HTML pages, requiring no user interaction beyond standard web browsing.
The vulnerability requires the attacker to have already compromised the renderer process, limiting real-world exploitation to targeted attacks; a standard security patch with no indication of active campaigns.
This sandbox-escape scenario requires prior renderer compromise, but elevates the risk for attackers seeking to escalate from an already-compromised rendering process (e.g., via exploit or social engineering) to system-level access.
This is a pure patch notification with no evidence of active exploitation or coordinated attacks; the vulnerability requires targeted user interaction.
This is a pure patch announcement with no indication of active exploitation or specific threat actors; only the technical vulnerability and required minimum version are documented.
This is a pure patch notice for a vulnerability already documented in the Chromium security advisory with no evidence of active in-the-wild exploitation.
The CVE affects Chrome's sandbox environment and requires user interaction (visiting a crafted webpage), which reduces exploitation risk in a managed enterprise environment with current browser versions.
The vulnerability affects the ANGLE rendering engine in Chrome and enables remote code execution through crafted HTML pages, representing a high risk for browser-based attack vectors.
The vulnerability allows attackers to execute arbitrary code within the Chrome sandbox via crafted HTML pages, posing a direct risk to users who open web content from untrusted sources.
The vulnerability enables data leakage across process boundaries if the renderer is compromised , a risk for sensitive data in browser-based business applications.
This vulnerability enables RCE via a crafted HTML page without additional user interaction through the ANGLE browser rendering engine.
A use-after-free vulnerability in Chrome's renderer process allows an attacker with renderer-process access to bypass the sandbox and potentially gain system control.
This vulnerability affects the ANGLE graphics library in Chrome and enables information disclosure from process memory; patch should be deployed promptly as Chrome versions prior to 148.0.7778.216 are affected.
The vulnerability enables sandbox bypass via crafted HTML pages, going beyond a simple DoS flaw and creating serious privilege-escalation risks on endpoints.
This is a standard patch notice with no evidence of active exploits or campaigns; it is a regular vulnerability with sandbox context, not an immediate strategic threat to manufacturing operations.
This vulnerability allows attackers to break out of the browser sandbox and execute arbitrary code by opening a crafted PDF file in Chrome.
CVE-2026-9961 is a use-after-free vulnerability in Chromium with high severity rating; it could lead to heap corruption via crafted HTML pages and requires immediate update to Chrome 148.0.7778.216 or later.
The vulnerability enables remote code execution within the Chrome sandbox via crafted HTML pages, requiring only that a user opens a malicious page.
The vulnerability enables remote code execution through crafted HTML pages without additional user interaction and affects Chrome's ANGLE rendering engine,critical for production environments.
The vulnerability allows an attacker with control of the renderer process (e.g., after XSS or drive-by download) to escape the sandbox, enabling system access and lateral movement , not merely browser crash.
The vulnerability enables sandbox escape via GPU rendering defects, allowing remote code execution on Windows/Linux systems without user interaction.
The vulnerability enables code execution within the Chrome sandbox via crafted HTML pages, potentially allowing attackers to bypass browser isolation mechanisms.
An out-of-bounds write flaw in Chrome's V8 engine allows attackers to execute arbitrary code within the browser sandbox via crafted HTML pages , a direct risk for employees using Chrome for business purposes.
A high-severity RCE in Chrome via USB implementation requires immediate patching, as users are at risk from crafted HTML pages with minimal user interaction.
A use-after-free vulnerability in Google's Glic component enables remote code execution within the Chrome sandbox via crafted HTML pages and requires immediate update to version 148.0.7778.216 or later.
The vulnerability requires an already-compromised renderer process as a precondition , it is not a primary attack vector but rather an escalation mechanism for post-compromise scenarios.
The vulnerability requires an already-compromised renderer process as a prerequisite; for Joel Traber AG, the risk is moderate as it presumes a multi-stage attack chain (initial compromise → renderer exploit → site isolation bypass).
A type confusion vulnerability in Skia's rendering engine allows attackers to execute code within Chrome's sandbox and potentially access user data or the underlying system.
A use-after-free vulnerability in Chrome's UI component allows remote code execution through crafted HTML pages; patch 148.0.7778.216 addresses the flaw.
The vulnerability requires an already-compromised renderer process, limiting practical attack surface to advanced exploits, but UI spoofing could be abused for phishing attacks.
Use-after-free vulnerability enables remote code execution in Chromium browser via malicious HTML; immediate patching required across all client systems.
The vulnerability allows an attacker with renderer-process access to perform a sandbox escape via a crafted HTML page; this is a theoretical risk with no known active exploitation in the wild.
The vulnerability requires an already-compromised renderer process as a prerequisite and is therefore primarily an escalation vulnerability for multi-stage attacks, not a standalone remote code execution.
Without detailed descriptions of individual vulnerabilities or active exploits, this is a routine patch notification; no strategic threat apparent.
The alert is a pure patch announcement without information on active exploits, affected users, or attack patterns.
BSI warns of multiple unspecified vulnerabilities in 7-Zip triggered by user interaction with manipulated files,advisory lacks CVE numbers or PoC details.
BSI warning regarding multiple unspecified vulnerabilities in widely deployed browsers without disclosure of specific CVE numbers or patch availability.
BSI advisory on multiple AMD processor vulnerabilities with potential for privilege escalation and code execution; no specific CVE numbers mentioned in the teaser.
This is a standard NVD patch notification with no indication of active exploitation or strategic threat.
No changes in this category.
No changes in this category.
The vulnerability is being actively exploited to deliver credential-stealing malware disguised as legitimate Fortinet updates through VPN scripting workflows.
137 Microsoft vulnerabilities published in May 2026, including critical RCE in Windows Netlogon and DNS Client with no known active exploitation.
ModeloRAT campaign exploits trusted Microsoft Teams as delivery vector for multi-stage attack with privilege escalation via CVE-2023-36036 to domain compromise, demonstrating that internal communication channels can be weaponized despite authentication mechanisms.
An unprivileged local user can exploit a race condition in AppArmor SAUCE patches to achieve arbitrary code execution, which is particularly relevant for multi-tenant environments.
An unprivileged local user can bypass AppArmor security policy enforcement through a heap overflow in notification handling code, posing a security risk on systems with AppArmor mandatory access control policies.
GreyVibe demonstrates a new attack model where Russia-linked threat actors systematically leverage AI tools to automate and escalate cyberoperations against Western targets.
GCHQ director confirms Russian daily operations against UK critical infrastructure (subsea cables, energy pipelines) and sanctions-evasion networks , signals escalated hybrid-warfare tactics with potential spillover effects on DACH energy and supply chains.
Chinese state-sponsored actors are using AI-driven automation to execute supply chain attacks in real time with minimal human involvement,a new escalation pattern for European manufacturing firms.
The vulnerability is actively being exploited in fresh attack campaigns post-April patch to deploy information-stealing malware.
Attackers abuse the trust relationship of endpoint management infrastructure to deliver malware directly to all managed endpoints via seemingly legitimate patches, enabling MFA bypass through stolen session cookies.
An unprivileged local user can trigger a memory-management bug in the kernel via AppArmor SAUCE patches, leading to slab metadata corruption and resource exhaustion.
The vulnerability allows an unprivileged local user to read sensitive information from kernel memory and can serve as a stepping stone for privilege-escalation attacks.
A privilege escalation vulnerability in the Linux kernel (AppArmor SAUCE patches) allows an unprivileged local user to trigger kernel panic or deadlock, causing system unavailability.
A locally-exploitable kernel panic in AppArmor requires a security update for Ubuntu production systems to maintain availability, but cannot be exploited remotely.
A remote code execution in Veeam Service Provider Console enables unauthorized access to backup infrastructure and potential compromise of business-critical data.
A vulnerability in 7-Zip enables arbitrary code execution by simply opening a malicious archive file, requiring no additional user interaction.
Both vulnerabilities enable remote code execution on critical backup systems, with at least one exploitable without authentication.
The vulnerability requires local access and causes kernel crash (DoS) but does not pose an immediate remote exploitation risk; patches for Ubuntu 6.8, 6.17, and 7.0 should be scheduled.
UNC6692 employs targeted social engineering via Teams fake invitations to deploy a modular custom malware suite,a tactic equally applicable to manufacturing environments.
The alert confirms a new Microsoft security update without details on active exploitation or campaigns; patch information should be validated via MSRC or BSI advisories.
Exploitation of this vulnerability allows local attackers to gain administrative privileges on Windows systems, potentially compromising backup integrity and enabling data exfiltration.
A critical vulnerability in Veeam allows authenticated Backup Administrators to write arbitrary files on Linux systems, potentially compromising the integrity of the backup infrastructure.
BSI update on multiple Intel processor vulnerabilities with privilege escalation and DoS potential requires patch management across all affected systems.
A BSI warning regarding multiple vulnerabilities in Veeam Backup & Replication signals elevated priority for patching, as this solution is central to the company's data protection and recovery strategy.
BSI advisory without specific CVE numbers or technical details; typical pattern of generic security warnings without documented active exploits in the wild.
BSI warns of multiple unspecified vulnerabilities in Adobe Creative Cloud applications without concrete CVE numbers or patching information; the advisory is generic and requires clarification of affected versions and available patches.
BSI warns of multiple yet-to-be-publicly-disclosed Edge vulnerabilities with unclear impact and exploit status; patch availability not announced.
The Gentlemen RaaS combines robust encryption with aggressive self-propagation and credential-theft campaigns, enabling rapid network-wide compromise.
CISA warns of currently active supply-chain attacks on multiple popular developer tools, with 42 TanStack packages comprising 84 versions compromised within 6,20 minutes; affected organizations should immediately reset credentials and audit installations.
Unpatched 0day in Windows library-ms with low CVSS (3.5) and user-interaction requirement; enables NTLM-response disclosure when viewing malicious folder content.
A yet-unpatched (0-day) Microsoft Office vulnerability enables disclosure of NTLM responses when exploited through user interaction, potentially laying groundwork for credential harvesting or follow-up attacks.
The BSI warning covers multiple unspecified kernel vulnerabilities but requires CVE details and kernel version information for concrete patching priorities.
The BSI advisory lacks specific CVE identifiers and technical exploitation details, complicating immediate risk assessment for Ubuntu 24.04 systems.
BSI notification of Microsoft's monthly patch day , routine security updates with no specific CVEs or exploitation status disclosed.