NEW A2
99 CVE-2026-58525
This is a standard NVD patch notice without active campaign or in-the-wild exploitation details; likely already covered by BSI/CISA advisories.
Critical
CVSS
8.2
EPSS
0%
What has changed?
Comparing 8 July 2026 with the previous day 7 July 2026.
Newly added
29 NEW Russian state-sponsored threat actors C3
98 Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
Russian state-sponsored threat actors have already compromised Ubiquiti Edge OS routers into botnets for malware traffic proxying; three of the now-patched UniFi OS vulnerabilities have been flagged by CISA as actively exploited.
Critical
CVSS
10.0
EPSS
1%
NEW C3
97 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
GhostLock is a 15-year-old Linux kernel flaw now publicly disclosed with working exploit code offering 97% reliability for local privilege escalation and container escape.
Critical
CVSS
7.8
EPSS
0%
NEW A2
88 CVE-2026-60104: Bitwarden Server Authentication Request Vulnerability Allows Account Takeover
The vulnerability allows low-privileged organization members to impersonate other users and steal their vault keys, enabling complete account takeover and database access.
Critical
CVSS
7.3
EPSS
0%
Russia A3
85 «Security Switzerland 2026»: No all-clear for Switzerland
Swiss Federal Council warns of escalating Russian hybrid warfare against Switzerland and Europe; cyberspace and critical infrastructure identified as primary targets for espionage and attack activities.
Critical
Gamaredon C3
85 Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses
The Russian FSB is actively improving its malware delivery chains and server concealment techniques, indicating an escalated threat to European industrial networks.
Critical
C3
80 Europe Evolves Into Ransomware's Favorite Region
Ransomware-as-a-Service ecosystems are strategically shifting focus toward European organizations and their supply chains, signaling a deliberate repositioning of ransomware campaigns after a global lull.
Critical
NEW LapDogs (China-linked APT) C3
80 China-Linked APT Expands Arsenal With New 'Leash' Backdoors
A China-linked APT group is actively expanding its arsenal with new proprietary backdoor variants (LongLeash, DogLeash, JarLeash) for SOHO routers, signalling sustained investment in infrastructure compromise in the context of geopolitical tensions.
Critical
NEW UAT-7810 C3
75 China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Chinese APT UAT-7810 is actively developing custom malware (ShortLeash/LONGLEASH) to establish Operational Relay Box networks positioned as infrastructure provider for downstream threat actors,a strategic escalation pattern targeting high-value victims.
Critical
NEW Volt Typhoon C3
75 What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out
Volt Typhoon is portrayed as a persistent China-backed threat to Western critical infrastructure, signaling geopolitical cyber-warfare scenarios that indirectly threaten European supply chains and industrial operations.
Critical
NEW A2
71 CVE-2026-13129
A JavaScript-based field traversal vulnerability in PDF applications can cause application crash through invalid pointer dereference when a corrupted field form is opened.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57237
A memory-corruption flaw in PDF applications can be triggered by malicious JavaScript in form fields, leading to application crashes; remote code execution potential is unclear from the advisory.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57238
The vulnerability causes DoS through invalid object access after JavaScript deletion of form fields in PDF documents; no remote code execution.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57245
The vulnerability enables a heap corruption condition through improper validation of PDF annotation relationships, potentially leading to crashes or code execution.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57250
A flaw in PDF applications enables crash-through-service via malformed JavaScript form fields without validation checks.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57252
The vulnerability enables PDF application crashes through manipulated JavaScript code during page deletion and annotation removal, with no remote code execution or data loss documented.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-57256
A validation failure in PDF form objects during JavaScript execution leads to invalid pointer access and application crash, potentially exploitable for denial-of-service.
High
CVSS
7.8
EPSS
0%
NEW C3
70 Ubiquiti warns of new max severity UniFi OS vulnerability
A maximum-severity vulnerability in Ubiquiti UniFi OS requires immediate attention as this component is central to network management and segmentation.
Critical
NEW A2
68 CVE-2026-57239
The vulnerability allows local users to escalate privileges to NT AUTHORITY\SYSTEM level via user-controllable executable files; however, the vendor, PoC status, and active exploitation details remain unclear.
High
CVSS
8.2
EPSS
0%
NEW A2
55 CVE-2026-57255
Memory vulnerability in PDF rendering enables remote denial-of-service through malformed color spaces; attack vectors via email attachments or SharePoint documents are likely.
Medium
CVSS
6.1
EPSS
0%
NEW A2
53 CVE-2026-59998: OpenSSH GSSAPIStrictAcceptorCheck Bypass in Windows Active Directory
The vulnerability documents an undocumented security behavior in OpenSSH within Windows AD environments where GSSAPI strict checks fail to activate , a previously undisclosed configuration edge case with potential authentication bypass implications.
Medium
CVSS
4.8
EPSS
0%
NEW A3
47 [UPDATE] Apache log4j: Vulnerability Enables Code Execution
BSI warning on log4j vulnerability underscores persistent risk posed by ubiquitous component in European production environments.
Critical
B3
20 Introduction to COM usage by Windows threats
Researchers systematically document how malware abuses COM interfaces for lateral movement, persistence, and Windows automation, with Qakbot presented as a case study and reverse-engineering tools discussed.
High
NEW A3
20 [UPDATE] OpenSSH: Multiple Vulnerabilities
The BSI advisory covers multiple OpenSSH vulnerabilities without naming CVE numbers or specific version details,a typical aggregated advisory lacking clarity on exploit status.
High
A3
20 Google Chrome: Multiple Vulnerabilities Allow Unspecified Attack
BSI warns of multiple Chrome vulnerabilities without published details; this suggests embargoed or yet-to-be-disclosed security flaws that may be patched imminently.
High
NEW C3
20 Entra passkey enrollment vishing targets Microsoft 365 users
Attackers use social engineering tactics to trick users into registering passkeys in Entra ID, thereby bypassing multifactor authentication.
High
NEW B3
20 Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Unattributed active campaign since April 2026 uses deceptive photo archives as entry point for multi-stage intrusion with persistent Node.js implant and obfuscated PowerShell.
High
A3
20 Google Chrome and Microsoft Edge: Multiple Vulnerabilities
The BSI warning is a collection advisory covering multiple browser vulnerabilities without specific CVE identification; prioritizing patches requires identifying the specific CVEs affecting Chrome and Edge versions in use.
High
NEW EvilTokens C3
15 New Ghost Phishing Wave Is Breaking Traditional Email Security
EvilTokens uses AES-GCM-encrypted HTML payloads that decrypt only in the browser to bypass traditional email security inspections and conduct device-code phishing attacks against Microsoft 365 accounts.
High
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
13 NEW C3
100 BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
Prior BeyondTrust flaws have been actively exploited for web shell and backdoor deployment, justifying urgent patch prioritization for these critical authentication bypass vulnerabilities.
Critical
CVSS
9.2
EPSS
0%
NEW ToddyCat B3
75 Threat landscape for industrial automation systems. Q1 2026
ToddyCat APT exploits OAuth token hijacking against Gmail and targets corporate email; spyware remains second-most common threat category in ICS environments.
Critical
NEW C3
63 BeyondTrust warns of critical flaws in remote access software
The alert mentions critical flaws in BeyondTrust software but provides no details on CVE numbers, attack scenarios, or active exploitation , the article appears incomplete or is a preview lacking substantive technical information.
Critical
B2
56 ZDI-26-355: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution upon user interaction with CVSS 7.8; no public exploitation known, but timely patching required.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-361: Adobe Acrobat Reader DC Field signatureInfo Use-After-Free Remote Code Execution Vulnerability
A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution when a user interacts with malicious documents or web pages.
Medium
CVSS
7.8
EPSS
0%
A3
20 Google Chrome / Microsoft Edge: Multiple Vulnerabilities
The BSI warns of multiple unspecified vulnerabilities in Chrome and Edge; without CVE numbers, precise risk assessment is currently not possible.
High
A3
20 Ubiquiti UniFi OS: Multiple Vulnerabilities
BSI warning on critical vulnerabilities in Ubiquiti UniFi OS with RCE and privilege escalation potential requires prompt patch review in network infrastructure.
High
A3
20 7-Zip: Multiple Vulnerabilities
BSI warns of multiple unspecified vulnerabilities in 7-Zip with code execution potential; specific CVE numbers and technical details are missing from this advisory.
High
NEW C3
20 Linux Kernel: 16-year-old KVM vulnerability enables VM escape
A long-overlooked KVM vulnerability allows attackers within virtual machines to escape their isolated environment and gain kernel privileges on the host system.
High
A3
20 [UPDATE] OpenSSL: Multiple Vulnerabilities
The BSI warns of multiple OpenSSL vulnerabilities without specific CVE references in this notice; this indicates a summary or update of multiple already-known vulnerabilities.
High
NEW Storm-2372 C3
20 DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
The campaign abuses legitimate Microsoft authentication mechanisms instead of fake login pages, combining collaboration-themed lures with OAuth Device-Flow exploitation to bypass MFA and gain persistent account access.
High
NEW C2
17 Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems
Januscape is the first known KVM vulnerability that can be exploited on both Intel and AMD architectures, enabling direct guest-to-host escape.
High
NEW A3
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities Enable Denial of Service
BSI advisory on multiple Linux Kernel DoS vulnerabilities without specific CVE references or exploitation details; urgency and affected versions remain unclear.
Medium