NEW A2
95 CVE-2023-45858
Beyond the plain patch information, the alert provides no evidence of active exploitation; the flaw allows reading local files and is fixed in version 23.4.88.1429.
Critical
CVSS
8.6
EPSS
0%
What has changed?
Comparing 14 September 2026 with the previous day 7 September 2026.
Newly added
17 NEW Sandworm C3
85 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The GRU actor Sandworm is chaining Cisco vulnerabilities to spread an upgraded Cyclops Blink variant and maintain persistent control over compromised network devices.
Critical
HoneyMyte B3
82 APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
The use of a signed kernel driver as a rootkit shows the group is deliberately bypassing EDR detection on Windows endpoints and servers, not merely exfiltrating data.
Critical
UAT-10147 B3
80 UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
For the first time, an APT actor is documented systematically using agentic AI tooling (playbooks, exploit automation, payload generation) across the entire post-compromise lifecycle, significantly increasing the speed and scalability of intrusions.
Critical
NEW A2
76 CVE-2023-28148
The report provides no information beyond the patch details about active exploitation or new attack vectors.
Critical
CVSS
7.2
EPSS
0%
NEW A2
74 CVE-2026-85921
The report provides no information beyond the plain CVE description; there is no indication of active exploitation, a PoC, or threat actors.
High
CVSS
8.2
EPSS
0%
NEW A2
71 CVE-2026-85892
Beyond the pure patch information, the report provides no indications of active exploitation, threat actor groups, or affected victim sectors.
High
CVSS
7.8
EPSS
0%
NEW A2
30 CVE-2023-22631
Beyond the plain patch information, the report adds no new insight: there is no indication of active exploitation, nor any details on TTPs or affected sectors.
Low
CVSS
2.7
EPSS
0%
UAT-10147 B3
15 UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
The combination of a Linux kernel rootkit, BYOVD EDR neutralisation and cross-platform C2 in a single, widely deployed implant shows that kernel-level evasion techniques are no longer reserved for top-tier state actors.
High
NEW C3
0 ClickFix Campaigns Abuse Legitimate Services for Persistent Access
ClickFix campaigns use legitimate system services for persistent attacks and therefore require user awareness rather than pure patch management.
Medium
NEW A3
0 Microsoft Edge: Vulnerability allows Cross-Site Scripting
Medium
A3
0 [UPDATE] 7-Zip: Vulnerability allows bypassing security restrictions
Medium
NEW A3
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities
The report does not provide specific CVE IDs or attack details, so the actual exposure and urgency remain unclear.
Medium
NEW A3
0 [UPDATE] Google Chrome/Microsoft Edge: Multiple Vulnerabilities
Medium
NEW A3
0 UPDATE: Paessler PRTG: Vulnerability Allows Information Disclosure
The vulnerability in Paessler PRTG allows information disclosure, which can compromise the confidentiality of monitoring data.
Medium
NEW A3
0 [UPDATE] Paessler PRTG: Multiple Vulnerabilities
Medium
NEW A3
0 [UPDATE] OpenSSH: Multiple Vulnerabilities
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
6 NEW C3
20 BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
Unlike pure patch reports, this article describes an ongoing phishing campaign specifically bypassing MFA for Microsoft 365, highlighting concrete risks to access security.
High
NEW C3
20 TeamViewer patches high-risk vulnerabilities in clients
Authenticated attackers can execute malicious code in user context via path-traversal in file transfer and virtual file-clipboard; updates to version 15.81.5 are available.
High
NEW C3
20 Patch now! Attackers targeting PaperCut NG/MF
Attackers are actively exploiting a previously undocumented vulnerability in PaperCut NG/MF; administrators can initially only check for compromises using incomplete indicators of compromise.
High
A3
20 [UPDATE] OpenSSL: Multiple Vulnerabilities
BSI warns of multiple OpenSSL vulnerabilities with RCE, DoS, and information disclosure potential; UPDATE designation indicates patch availability.
High
NEW C3
20 PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
PEEP demonstrates a novel post-compromise tactic that abuses legitimate browsers as a backdoor channel and bypasses Chromium security mechanisms without requiring user interaction.
High
A3
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities
The BSI bundles several kernel vulnerabilities without detailed CVE information in one advisory, underlining the need for a timely kernel update on affected Linux systems.
Medium