NEW
94 CVE-2022-49042
The vulnerability allows local users to execute arbitrary code on backup management systems, compromising the integrity of backup infrastructure.
Critical
CVSS
7.8
EPSS
0%
What has changed?
Comparing 3 June 2026 with the previous day 27 May 2026.
Newly added
17 NEW
92 CVE-2022-49036 , Arbitrary Code Execution in Synology Active Backup for Business Recovery Media Creator
Local code execution vulnerability in Synology Active Backup for Business requires patching to version 2.5.0-2081 or later to mitigate risks from local attackers.
Critical
CVSS
7.8
EPSS
0%
NEW Chinese APT C3
80 Chinese hackers use new Atlas RAT malware in European cyberattacks
New Atlas RAT malware demonstrates targeted adaptation by Chinese APT groups toward European infrastructure and signals escalation of DACH-region targeting.
Critical
NEW
70 Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
The vulnerability exploits URI handler mechanisms to force network authentication, enabling passive capture of NTLMv2 hashes without requiring user interaction.
High
CVSS
4.3
EPSS
0%
NEW C3
70 Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover
A debugging error in Microsoft 365 Android apps (Excel, Word, PowerPoint, OneNote, Loop, Copilot) disabled a critical security setting for token protection validation in production releases, allowing attackers to steal authentication tokens and take over accounts.
Critical
NEW
63 Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
A large-scale npm supply chain attack compromises 32 packages under the @redhat-cloud-services scope via CI/CD pipeline infiltration, where attackers abused legitimate GitHub Actions OIDC workflows to publish trojanized packages with authentic signatures.
Critical
NEW
52 CVE-2024-47273
A path-traversal vulnerability in Synology Hyper Backup before version 4.1.2-4036 allows authenticated users to write arbitrary files and potentially compromise the integrity of backup systems.
Medium
CVSS
4.3
EPSS
0%
NEW
50 CVE-2024-47263
Path-traversal vulnerability in Hyper Backup allows authenticated administrators to write non-sensitive files via unspecified vectors , requires admin privileges and is already fixed in version 4.1.2-4036.
Medium
CVSS
4.1
EPSS
0%
NEW
37 Mozilla Firefox and Thunderbird: Multiple Vulnerabilities
Three of the patched vulnerabilities are already being actively exploited for remote code execution; immediate updates required.
Critical
NEW
20 Microsoft Defender and Malware Protection Engine: Multiple Vulnerabilities
BSI warns of multiple vulnerabilities in Microsoft Defender and Malware Protection Engine that enable attackers to achieve local privilege escalation, code execution, and denial of service.
High
NEW
20 New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
The vulnerability affects HTTP/2 default configurations across multiple web server vendors and enables unauthenticated remote DoS , a newly discovered classification issue, not merely a patch.
High
NEW
20 'HTTP/2 Bomb' Exploit Knocks Web Servers Offline in Seconds
A novel attack combination exploits HTTP/2 compression bombs and Slowloris-style techniques to incapacitate web servers without requiring specific patches.
High
NEW
20 Mozilla Firefox: Multiple Vulnerabilities Enable Unspecified Attack
High
NEW A3
20 CVE-2026-42840
An authenticated user can inject persistent JavaScript into a customer record and compromise every POS operator in the organization who retrieves that record.
High
EPSS
0%
NEW C3
20 Attackers Use AI to Automate EDR Evasion Testing
Attackers are using AI-driven automation to systematically test and refine evasion techniques against EDR solutions , signaling a professionalization of attack preparation workflows.
High
NEW
17 VS Code zero-day lets hackers steal GitHub tokens in one click
A zero-day vulnerability in VS Code enables attackers to exfiltrate GitHub tokens with minimal user interaction, potentially compromising access to code repositories and CI/CD pipelines.
High
[UPDATE] Intel Processor: Multiple Vulnerabilities
BSI advisory on Intel processor vulnerabilities without CVE identifiers; specific versions and affected processor generations must be retrieved from the complete BSI publication.
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
36 KEV NEW CL-STA-1132
83 Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Unit 42 documents active, likely state-sponsored exploitation (CL-STA-1132) of a PAN-OS zero-day enabling unauthenticated remote code execution, targeting critical network perimeter infrastructure.
Critical
CVSS
9.8
EPSS
5%
KEV NEW CL-STA-1132
75 Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)
CL-STA-1132, a likely state-sponsored threat cluster, actively exploits CVE-2026-0300 and deploys open-source tunneling tools and Active Directory enumeration following initial compromise.
Critical
CVSS
9.8
EPSS
5%
NEW
100 CVE-2025-12686
A remote code execution vulnerability in BeeStation Manager requires attention if the product is deployed, but does not affect standard Synology DSM devices typically used in manufacturing environments.
Critical
CVSS
9.8
EPSS
0%
NEW
98 CVE-2025-13392
An authentication bypass in Synology DSM SSO module allows unauthorised access to NAS systems with knowledge of LDAP Distinguished Names, without requiring a password.
Critical
CVSS
8.1
EPSS
0%
NEW
97 CVE-2025-41669
The vulnerability allows local users to install unsigned APP packages on PLCnext controllers without integrity verification, leading to root-level code execution,a critical risk for connected industrial automation systems.
Critical
CVSS
8.8
EPSS
0%
NEW
92 CVE-2026-45108: Himmelblau Authentication Bypass in Device Authorization Grant Flow
The vulnerability allows any user in the same Entra ID domain to authenticate locally as another user on Unix systems because the DAG flow validates domain aliases but fails to verify the complete UPN username component.
Critical
CVSS
8.4
EPSS
0%
NEW
89 CVE-2026-45574: epa4all-client TLS Certificate Validation Bypass Allows SOAP Traffic Interception
The vulnerability enables passive network attackers to intercept sensitive healthcare data (patient identifiers, SMC-B operations, document content) in the Telematik infrastructure without active exploitation.
Critical
CVSS
8.1
EPSS
0%
MuddyWater (Seedworm)
85 Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware
MuddyWater (Iranian state-sponsored APT) weaponizes Chaos ransomware as cover for targeted operations against Western infrastructure, masking state-sponsored intent as criminal RaaS activity.
Critical
NEW
80 Disputed Powers: BKA Receives Access to Attacker Infrastructure
Germany's Cabinet has granted the BKA new powers for active cyber defense, including the right to infiltrate and disrupt or destroy foreign IT systems , a measure that carries significant risks to uninvolved third parties, as attackers routinely use compromised systems as springboards.
Critical
NEW
80 State-sponsored actors, better known as the friends you don't want
State-sponsored actors differ fundamentally from financially motivated attackers: they do not use breaking-and-entering methods but instead compromise credentials and remain invisible for months using legitimate user tools.
Critical
NEW
80 Bill on Cybersecurity: Dobrindt Redefines Hackbacks
The German bill explicitly regulates hackbacks and active cyber defense for the first time, defining new legal boundaries and options for cyber countermeasures for German and European companies.
Critical
NEW
75 CVE-2026-2237 , Synology Storage Manager Information Disclosure via GET Request Sensitive Query Strings
The vulnerability requires local access and affects only sensitive parameter queries; no CVSS score or exploitability details are provided.
Critical
CVSS
6.2
EPSS
0%
OceanLotus
75 OceanLotus suspected of using PyPI to deliver ZiChatBot malware
OceanLotus leverages legitimate Python package repositories (PyPI) as a malware distribution channel to compromise developers and organizations with Python dependencies,a sophisticated supply-chain approach with potential DACH implications.
Critical
NEW
74 CVE-2025-13593: Synology ActiveProtect Agent Origin Validation Vulnerability Allows Arbitrary File Write
A local validation flaw in Synology ActiveProtect Agent allows locally authenticated users to write arbitrary files with restricted content during installation, potentially compromising backup operation integrity.
High
CVSS
6.1
EPSS
0%
NEW
74 CVE-2025-66592: Synology Active Backup for Business Agent Origin Validation Error Allows Arbitrary File Write
The vulnerability allows local attackers to write arbitrary files with restricted content during installation,an installation-time attack that requires privileged access and therefore poses moderate risk to isolated backup systems.
High
CVSS
6.1
EPSS
0%
NEW
74 CVE-2025-66593 , Synology Assistant Origin Validation Error Allows Arbitrary File Write During Installation
The vulnerability allows local users to write arbitrary files with restricted content during installation,a critical risk in production environments where installation runs with elevated privileges.
High
CVSS
6.1
EPSS
0%
NEW
59 CVE-2024-47268
The vulnerability allows already-authenticated administrators to obtain sensitive information via undocumented vectors , an insider-risk scenario in surveillance-critical systems.
Medium
CVSS
4.9
EPSS
0%
NEW
59 CVE-2024-47269 , Cleartext Transmission of Sensitive Information in Synology Surveillance Station
The vulnerability allows authenticated administrators to access sensitive export keys in cleartext, posing a significant data risk for surveillance systems.
Medium
CVSS
4.9
EPSS
0%
NEW
51 UniFi OS Server: Update Against Critical Security Vulnerabilities
Five critical vulnerabilities in UniFi OS Server enable unauthorized system access by network-adjacent attackers; CVE-2026-34908 with CVSS score 10.0 represents maximum risk.
Critical
NEW
51 Kali365 phishing kit bypasses MFA and steals Microsoft logins
Kali365 bypasses MFA by stealing access and refresh tokens rather than passwords, enabling persistent access to Outlook, Teams, and OneDrive without repeated login attempts.
Critical
Microsoft Patch Tuesday for May 2026 , Snort rules and prominent vulnerabilities
Microsoft Patch Tuesday for May 2026 includes 137 vulnerabilities with 31 critical, including RCEs in Windows Services, Office, Azure and SharePoint , no active exploitation observed.
Critical
NEW
33 CVE-2024-47272: Incorrect Authorization Vulnerability in Synology Surveillance Station
The vulnerability requires existing elevated admin privileges and restricts write access to unspecified vectors, reducing practical exploitation risk for external attackers.
Low
CVSS
2.7
EPSS
0%
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
Unit 42 documents advanced AD CS misuse techniques for privilege escalation through misconfigured certificate templates and PKINIT-based authentication bypass observed in nation-state attack campaigns.
Critical
NEW
20 7-Zip: Vulnerability Enables Code Execution
The BSI warns of a critical remote code execution vulnerability in 7-Zip when processing NTFS archives, which requires user interaction but poses significant security implications.
High
NEW
20 [UPDATE] Microsoft DeveloperTools: Multiple Vulnerabilities
BSI advisory covering multiple vulnerabilities in Microsoft Developer Tools without specific CVE numbers or exploitation status , typically aggregated patch information from ongoing security updates.
High
NEW
20 [UPDATE] OpenSSL: Multiple Vulnerabilities
BSI warning on multiple OpenSSL vulnerabilities without specific CVE references , requires clarification via direct BSI source or CISA cross-reference for concrete patching priorities.
High
NEW
20 SymJack Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems
SymJack demonstrates that AI coding agents can be tricked via malicious symlinks and repositories into installing attacker-controlled MCP servers, enabling compromise of CI/CD pipelines and secret exfiltration.
High
NEW
20 [UPDATE] Synology DiskStation Manager: Vulnerability Enables Security Control Bypass
The BSI alert documents an active threat to Synology NAS systems commonly deployed in the DACH region, without a CVE identifier available, suggesting ongoing analysis or embargo-protected disclosure.
High
Google Chrome: Multiple Vulnerabilities
BSI warns of multiple unspecified Chrome vulnerabilities without naming specific CVE IDs or affected versions; the exact risk remains unclear until full disclosure.
High
NEW
20 CVE-2026-42789: Improper Certificate Chain Validation in Erlang OTP public_key Module Allows Certificate Forgery
The vulnerability allows an attacker with access to a non-CA certificate to forge arbitrary leaf certificates and thereby impersonate servers or clients in mTLS environments, representing a fundamental breach of the PKI chain of trust.
High
EPSS
0%
NEW Akira
20 Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs
Akira intrusion demonstrates typical pattern: initial authentication via SSLVPN, lateral movement exclusively via RDP over two days, Kerberoasting and defense evasion through Event Log deletion,all activity was visible in standard logs but required proactive correlation between firewall and endpoint logs.
High
NEW
17 From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
Attackers combine search engine poisoning with AI chatbot manipulation to distribute counterfeit utility downloads that inject GPU-mining malware via DLL sideloading,an escalation of supply-chain social engineering tactics.
High
NEW
17 7-Zip: Critical Vulnerability Allows Code Injection
A critical vulnerability in 7-Zip allows code injection through archives and requires prompt patching across all affected company systems.
High
NEW
0 Microsoft: Defender to Automatically Isolate Compromised Devices Soon
Microsoft announces an automatic network isolation feature in Defender that will proactively limit damage upon attack detection,a preventive defensive capability rather than a patch.
Medium
NEW
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities
BSI warning regarding multiple unspecified Linux kernel vulnerabilities without concrete CVE identifiers complicates risk prioritization for organizations with Ubuntu deployments.
Medium
NEW
0 CVE-2026-46061: Linux Kernel jbd2 Deadlock in jbd2_journal_cancel_revoke()
The vulnerability causes an ABBA deadlock in filesystem operations and can cause system hang, but only under specific conditions (blocksize < pagesize).
Medium
EPSS
0%