Comparing 29 May 2026 with the previous day 22 May 2026.
CVE-2026-0265 enables authentication bypass in Palo Alto Networks firewalls with Cloud Authentication Service enabled; no public exploits available yet but practical exploitability confirmed with technical details pending disclosure.
Kimsuky has developed two variants of the httpMalice backdoor: an HTTP/HTTPS variant (v1.9) with Windows service persistence and an older Dropbox-API-based variant (v1.8), which could target European and DACH organizations.
Russian threat actor leverages generative AI (ChatGPT, Gemini) for highly personalized phishing lures , a TTP escalation that could transfer to European organizations.
This is patch information without evidence of active exploitation or specific attack campaigns; the vulnerability is documented as a standard NVD advisory.
The vulnerability enables not only code execution within the Chrome renderer but also potential sandbox escape, which could allow local system compromise.
The vulnerability requires a pre-compromised renderer process first, making it not a direct remote code execution scenario without prior compromise.
The vulnerability enables remote code execution within the Chrome sandbox via a crafted HTML page and requires immediate update to version 148.0.7778.216 or later.
A critical out-of-bounds write vulnerability in ANGLE's graphics engine enables remote code execution via plain HTML pages, accelerating browser-based attacks on employees.
This is an already-known patch notification from NVD/Chromium without evidence of active exploitation or campaigns in the wild.
A critical use-after-free vulnerability in Chrome enables arbitrary code execution via crafted HTML pages; the CVE is already classified as Critical by authoritative sources (NVD, Chromium Security) and represents standard patch routine, not an active campaign.
The vulnerability enables remote code execution via crafted PAC scripts and particularly threatens environments with managed proxy configurations or enterprise PAC files.
A critical use-after-free vulnerability in Chrome's XR module allows an attacker with renderer process access to escape the sandbox,a direct threat for browser-based attack vectors on Windows systems.
A critical use-after-free vulnerability in Skia allows an attacker with access to the renderer process (e.g. through malicious HTML) to achieve a sandbox escape.
Active supply-chain attack on npm ecosystem with targeted theft of AWS, Vault, and CI/CD secrets through typosquatting of well-known DevOps libraries.
BSI warning regarding multiple OpenSSL vulnerabilities with potential code execution and denial-of-service; update information without specific CVE details in this summary.
Rapid7 MDR observed active exploitation of this authentication bypass by multiple attackers against numerous customers; the vulnerability enables unauthenticated remote access to VPN gateways under specific configurations.
The vulnerability allows an attacker with access to the renderer process (e.g., via drive-by download or malicious website) to potentially escape the Chrome sandbox and execute system-level code.
The vulnerability enables sandbox escape following renderer process compromise, which carries higher attack potential for endpoints than routine patch management suggests.
Heap corruption vulnerability in Google's PDFium PDF renderer enables remote exploitation via crafted PDF files without user interaction in Chrome; high risk for organizations with PDF-processing workflows.
This vulnerability is already documented in the NVD (National Vulnerability Database) and requires active user interaction with specific UI gestures, which limits practical exploitation in enterprise environments.
A race condition in Chrome's WebAudio API prior to version 148.0.7778.216 enables remote code execution within the sandbox,a critical direct security issue that endangers users visiting crafted web pages.
This is a standard patch advisory with no indication of active exploitation or targeted campaigns.
This is a standard patch notification with no indication of active exploitation or campaigns , a routine Chrome security update.
An integer overflow in ANGLE's graphics engine allows an attacker to leak data across origin boundaries via a crafted HTML page, indicating browser access and secure session data as attack targets.
The vulnerability requires a complex attack chain: it necessitates a pre-compromised renderer process, significantly raising the practical attack barrier and distinguishing this from direct remote code execution scenarios.
The vulnerability allows an attacker with a malicious extension to escape the browser sandbox, potentially enabling full system compromise.
The vulnerability requires a pre-compromised renderer process; the risk for Joel Traber AG is therefore limited to scenarios where malware first gains entry to the browser.
The vulnerability enables code execution within the Chrome sandbox by manipulating the V8 engine via crafted HTML pages, which could facilitate propagation through phishing or drive-by download attacks.
The vulnerability allows an attacker with a compromised renderer process to achieve sandbox escape via crafted HTML , this is a post-compromise escalation technique, not an initial attack vector.
The vulnerability requires an already-compromised renderer process; no independent remote code execution vector from the web is described, which limits practical exploitability.
The vulnerability requires an already-compromised renderer process, reducing practical attack likelihood and representing a secondary exploitation scenario.
A renderer process exploit enables a potential sandbox escape, allowing an already-compromised browser process to potentially gain full system privileges.
This vulnerability allows an attacker with access to the renderer process to escape the sandbox, breaking the isolation between web content and the operating system and enabling full system compromise.
An out-of-bounds read vulnerability in Google's ANGLE renderer enables memory disclosure on systems with Chrome < 148.0.7778.216 without requiring additional user interaction or elevated privileges.
A use-after-free vulnerability in the ANGLE renderer enables complete sandbox escape via crafted HTML pages,critical for secure browsing environments on Windows/Linux systems.
This is a standard Chrome security update with no signs of active exploitation or geopolitical implications; the NVD notice documents the patch date without additional strategic insights.
A remote attacker can exfiltrate cross-origin data via a crafted HTML page on Chrome versions prior to 148.0.7778.216.
This is a standard NVD patch advisory with no indicators of active exploitation or targeted campaigns; however, the sandbox escape requires prior renderer-process compromise as a precondition.
This is a standard NVD patch advisory for a Chrome vulnerability with no indication of active exploitation or an ongoing campaign.
The vulnerability enables out-of-bounds memory reads through crafted HTML pages with minimal user interaction beyond visiting a malicious website.
Sandbox escape vulnerability in Chrome allows attackers to execute exploit code without browser sandbox restrictions, potentially leading to unrestricted code execution on Windows clients (including at Joel Traber).
The vulnerability enables sandbox escape following renderer process compromise, but requires prior control of the renderer process and is thus secondary to other browser exploits.
The vulnerability enables code execution within Chrome's sandbox via crafted HTML pages and affects versions prior to 148.0.7778.216; no active exploit in the wild is known.
An out-of-bounds read vulnerability in Chrome's ANGLE rendering engine enables remote attackers to execute arbitrary code via crafted HTML pages, requiring no user interaction beyond standard web browsing.
The vulnerability requires the attacker to have already compromised the renderer process, limiting real-world exploitation to targeted attacks; a standard security patch with no indication of active campaigns.
This sandbox-escape scenario requires prior renderer compromise, but elevates the risk for attackers seeking to escalate from an already-compromised rendering process (e.g., via exploit or social engineering) to system-level access.
This is a pure patch notification with no evidence of active exploitation or coordinated attacks; the vulnerability requires targeted user interaction.
This is a pure patch announcement with no indication of active exploitation or specific threat actors; only the technical vulnerability and required minimum version are documented.
This is a pure patch notice for a vulnerability already documented in the Chromium security advisory with no evidence of active in-the-wild exploitation.
The CVE affects Chrome's sandbox environment and requires user interaction (visiting a crafted webpage), which reduces exploitation risk in a managed enterprise environment with current browser versions.
The vulnerability affects the ANGLE rendering engine in Chrome and enables remote code execution through crafted HTML pages, representing a high risk for browser-based attack vectors.
The vulnerability allows attackers to execute arbitrary code within the Chrome sandbox via crafted HTML pages, posing a direct risk to users who open web content from untrusted sources.
The vulnerability enables data leakage across process boundaries if the renderer is compromised , a risk for sensitive data in browser-based business applications.
This vulnerability enables RCE via a crafted HTML page without additional user interaction through the ANGLE browser rendering engine.
A use-after-free vulnerability in Chrome's renderer process allows an attacker with renderer-process access to bypass the sandbox and potentially gain system control.
This vulnerability affects the ANGLE graphics library in Chrome and enables information disclosure from process memory; patch should be deployed promptly as Chrome versions prior to 148.0.7778.216 are affected.
The vulnerability enables sandbox bypass via crafted HTML pages, going beyond a simple DoS flaw and creating serious privilege-escalation risks on endpoints.
This is a standard patch notice with no evidence of active exploits or campaigns; it is a regular vulnerability with sandbox context, not an immediate strategic threat to manufacturing operations.
This vulnerability allows attackers to break out of the browser sandbox and execute arbitrary code by opening a crafted PDF file in Chrome.
CVE-2026-9961 is a use-after-free vulnerability in Chromium with high severity rating; it could lead to heap corruption via crafted HTML pages and requires immediate update to Chrome 148.0.7778.216 or later.
The vulnerability enables remote code execution within the Chrome sandbox via crafted HTML pages, requiring only that a user opens a malicious page.
The vulnerability enables remote code execution through crafted HTML pages without additional user interaction and affects Chrome's ANGLE rendering engine,critical for production environments.
The vulnerability allows an attacker with control of the renderer process (e.g., after XSS or drive-by download) to escape the sandbox, enabling system access and lateral movement , not merely browser crash.
The vulnerability enables sandbox escape via GPU rendering defects, allowing remote code execution on Windows/Linux systems without user interaction.
The vulnerability enables code execution within the Chrome sandbox via crafted HTML pages, potentially allowing attackers to bypass browser isolation mechanisms.
An out-of-bounds write flaw in Chrome's V8 engine allows attackers to execute arbitrary code within the browser sandbox via crafted HTML pages , a direct risk for employees using Chrome for business purposes.
A high-severity RCE in Chrome via USB implementation requires immediate patching, as users are at risk from crafted HTML pages with minimal user interaction.
A use-after-free vulnerability in Google's Glic component enables remote code execution within the Chrome sandbox via crafted HTML pages and requires immediate update to version 148.0.7778.216 or later.
The vulnerability requires an already-compromised renderer process as a precondition , it is not a primary attack vector but rather an escalation mechanism for post-compromise scenarios.
The vulnerability requires an already-compromised renderer process as a prerequisite; for Joel Traber AG, the risk is moderate as it presumes a multi-stage attack chain (initial compromise → renderer exploit → site isolation bypass).
A type confusion vulnerability in Skia's rendering engine allows attackers to execute code within Chrome's sandbox and potentially access user data or the underlying system.
A use-after-free vulnerability in Chrome's UI component allows remote code execution through crafted HTML pages; patch 148.0.7778.216 addresses the flaw.
The vulnerability requires an already-compromised renderer process, limiting practical attack surface to advanced exploits, but UI spoofing could be abused for phishing attacks.
Use-after-free vulnerability enables remote code execution in Chromium browser via malicious HTML; immediate patching required across all client systems.
The vulnerability allows an attacker with renderer-process access to perform a sandbox escape via a crafted HTML page; this is a theoretical risk with no known active exploitation in the wild.
The vulnerability requires an already-compromised renderer process as a prerequisite and is therefore primarily an escalation vulnerability for multi-stage attacks, not a standalone remote code execution.
Without detailed descriptions of individual vulnerabilities or active exploits, this is a routine patch notification; no strategic threat apparent.
The alert is a pure patch announcement without information on active exploits, affected users, or attack patterns.
BSI warns of multiple unspecified vulnerabilities in 7-Zip triggered by user interaction with manipulated files,advisory lacks CVE numbers or PoC details.
BSI warning regarding multiple unspecified vulnerabilities in widely deployed browsers without disclosure of specific CVE numbers or patch availability.
BSI advisory on multiple AMD processor vulnerabilities with potential for privilege escalation and code execution; no specific CVE numbers mentioned in the teaser.
This is a standard NVD patch notification with no indication of active exploitation or strategic threat.
No changes in this category.
No changes in this category.
The vulnerability reveals that a previous SSH authentication fix was incomplete and remains exploitable by bypassing callback-type validation,a pattern indicating flawed security abstractions.
A privilege-escalation vulnerability in UniFi OS enables remote command execution for attackers with network access, directly compromising the central network-management infrastructure.
An access control vulnerability in UniFi OS allows network-adjacent attackers to make unauthorized system changes without requiring authentication.
Network access alone is sufficient to exploit a path-traversal vulnerability in UniFi devices for file manipulation and account compromise, without requiring authentication.
The vulnerability enables direct command execution on UniFi devices through network access by exploiting improper input validation, requiring immediate patch prioritization in Joel Traber AG's infrastructure.
The vulnerability requires existing network access and low privileges, limiting risk to internal threats or post-compromise scenarios.
Nation-state actors are operationalizing ROADtools to manipulate Entra ID tokens in targeted attacks; Microsoft has documented active APT use since 2021 against delegated administrative privileges.
Chinese nation-state APT exploits unconventional C2 channels (Discord, Microsoft Graph APIs) to infiltrate European governmental organizations, signaling elevated risk to critical infrastructure and potential supply-chain targets across the EU.
Screening Serpens deploys an evolved version of MiniJunk malware to infiltrate European targets; the threat actor employs sideloading techniques and .NET-specific code-execution methods for defense evasion.
A compromised TanStack token enabled attackers unrestricted access to Grafana's GitHub repositories because the token was not rotated , a classic sign of insufficient token hygiene in the supply chain.
Cloud Atlas employs new tools (PowerCloud, ReverseSocks) and combines legacy exploits (CVE-2018-0802) with modern evasion techniques (PowerShell archives, multi-channel C2 via Tor/SSH) to establish persistent control.
The vulnerability affects the TeamViewer DEX Platform (On-Premises) and allows low-privileged users to gain access to administrative functions,a significant risk for on-premises deployments in manufacturing environments.
Two critical Chrome vulnerabilities enable remote code execution through visiting a malicious website and require immediate update to version 148.0.7778.178/179.
BSI warns of multiple production-in-use vulnerabilities in UniFi OS Server with direct RCE potential; absence of CVE numbers suggests possible zero-days or coordinated disclosure.
BSI warning of multiple privilege escalation vulnerabilities in Microsoft Entra ID and Azure Resource Manager; these vulnerabilities enable unauthorized access to critical identity and resource management functions in hybrid cloud environments.
Kali365 is a Telegram-based phishing-as-a-service that steals OAuth tokens from Microsoft 365 environments, enabling widespread access rights; the FBI warns of active attacks in April.
BSI warns of active exploitation of a critical SharePoint vulnerability; organizations should immediately check for patches and monitor systems.
Kali365 abuses legitimate Microsoft authentication pages for persistent backdoor access; FBI warning signals active exploitation in the wild.
The BSI warns of multiple unspecified vulnerabilities in widely-used browsers without specific CVE references or documented active exploitation, suggesting a generalized patch advisory.
BSI warns of critical RCE vulnerability in SharePoint Server 2016/2019 that authenticated attackers can exploit to execute arbitrary code.
BSI warns of an authenticated privilege-escalation vulnerability in TeamViewer that allows local attackers or those with valid credentials to elevate to higher privileges.
The advisory lacks specificity regarding affected kernel versions and CVE identifiers; further details are required to assess exploitation status and patching priority for Ubuntu 24.04 LTS.
BSI warns of multiple systemd vulnerabilities with potential for denial-of-service and code execution with administrative privileges on Linux systems.
BSI advisory on multiple Linux kernel vulnerabilities without specific CVE disclosure or PoC status; concrete patch status and affected versions must be obtained from the full BSI report.
The vulnerability allows a local attacker to execute arbitrary code with elevated privileges, potentially resulting in complete system compromise and requiring immediate attention for patch management.
BSI warns of multiple Chrome vulnerabilities without detailed disclosure; patch status and exploitability still unclear.
BSI alerts to multiple unspecified vulnerabilities in Firefox/Thunderbird without CVE details; this is typically a precautionary announcement ahead of detailed security updates.
The BSI warns of multiple vulnerabilities in Synology DSM enabling various attack scenarios,from security measure bypass to data manipulation and DoS attacks.
BSI warns of multiple local vulnerabilities in Adobe Creative Cloud without specific CVE numbers; exploitation requires user interaction (malicious file) but poses risk to design and marketing teams.
Prototype pollution vulnerabilities in Adobe Acrobat and Reader enable remote code execution; BSI warns of active exploitation.
BSI warns of multiple vulnerabilities in Ubiquiti UniFi Play PowerAmp/Audio Port without specific CVE numbers or PoC details; exploitation status and affected version information are missing from the announcement.
The vulnerability requires user interaction (click on malicious URL), making the risk mitigable through security awareness and link validation, though typically not as critical as zero-click exploits.
BSI warns of multiple exploitable vulnerabilities in Firefox and Thunderbird that can be triggered by opening a malicious email or website , immediate patching required for enterprise clients.
The vulnerability requires social engineering (phishing for malicious links) for successful exploitation, which reduces attack risk for technically proficient organisations but still poses a threat to network infrastructure.
BSI warns of multiple privilege escalation vulnerabilities in Ubiquiti UniFi Network Application that enable account takeover and unauthorized privilege elevation.
The vulnerability allows attackers to abuse trusted Copilot summaries for phishing content, potentially tricking users into disclosing sensitive information.
The BSI alert on multiple RCE and privilege escalation vulnerabilities in Adobe Acrobat DC/Reader DC requires immediate patching action for all affected systems in the company.
Three critical vulnerabilities in UniFi OS are being actively exploited; Ubiquiti-based network access controls are at immediate risk.
Fox Tempest leverages compromised edge appliances (F5 firewalls) as durable enterprise footholds with limited visibility, combined with Confluence exploitation for lateral movement.
The vulnerability enables bypassing physical confirmation (User Presence) on FIDO/U2F security keys in SSH, allowing unattended authentication , critical for organizations using hardware keys to protect remote access.
OpenSSH-based remote access scenarios at Joel Traber AG may be affected by a vulnerability that bypasses key access restrictions and permits unrestricted use of forwarded keys on remote hosts.
BSI warns of multiple Linux kernel vulnerabilities causing DoS impact; specific CVE numbers and CVSS ratings are not provided in the advisory.
An authenticated remote exploitation in Synology DSM with information disclosure impact requires monitoring for available patches and access control enforcement.
BSI warns of multiple vulnerabilities in Chrome and Edge not yet publicly detailed; vendors are working on patches with details to follow.
Local code-execution vulnerability in Adobe Photoshop requiring user interaction (file opening); BSI warns of this flaw.
The BSI warns of multiple unspecified vulnerabilities in Microsoft Edge enabling information disclosure and manipulation; user interaction is required for exploitation.