NEW C3
80 China spy chief points at US AI models in cyber threat warning
China's spy chief warns of US AI models as accelerators for cyberattacks and vulnerability discovery, raising the threat from state actors.
Critical
What has changed?
Comparing 15 September 2026 with the previous day 14 September 2026.
Newly added
16 NEW C3
70 CISA: Critical VMware RCE flaw now exploited by ransomware gangs
The report confirms that the critical VMware vCenter vulnerability is already actively exploited by ransomware gangs, which goes beyond a mere patch warning.
Critical
NEW A3
54 CVE-2026-91721
Critical
EPSS
0%
NEW A3
20 CVE-2026-91709
The report provides no insights beyond patch information, as neither active exploitation nor attacker TTPs are mentioned.
High
EPSS
0%
NEW A3
20 CVE-2026-91711
The report contains no indication of active exploitation, exploit code, or strategic context and therefore does not go beyond pure patch information.
High
EPSS
0%
NEW A3
20 CVE-2026-91710
This report contains no information beyond the patch details; there is no evidence of active exploitation or a public exploit.
High
EPSS
0%
NEW A3
20 CVE-2026-91715
The report contains no details beyond the patch information, in particular no indication of active exploitation or threat actors.
High
EPSS
0%
NEW A3
20 CVE-2026-91718
High
EPSS
0%
NEW A3
20 CVE-2026-91733
The report contains no information beyond the pure patch details indicating active exploitation or strategic context.
High
EPSS
0%
NEW A3
20 CVE-2026-91736
High
EPSS
0%
NEW A3
20 CVE-2026-91737
The alert contains no information on active exploitation, threat actors, or TTPs and therefore does not go beyond pure patch information.
High
EPSS
0%
NEW C3
0 BambooToken malware controls Windows and Linux systems via MQTT
This report shows that attackers are using MQTT as a C2 channel for cross-platform malware, which can evade conventional network monitoring.
Medium
NEW A3
0 CVE-2026-91716
Pure CVE description with no indication of active exploitation, proof-of-concept or attacker TTPs , it adds nothing beyond the patch information (update to 153.0.8010.47).
Medium
EPSS
0%
NEW A3
0 CVE-2026-91738
The report contains only the NVD description of the vulnerability, without indications of active exploitation, affected sectors, or strategic implications.
Medium
EPSS
0%
NEW A3
0 CVE-2026-91743
Beyond the pure patch information, the report provides no evidence of active exploitation or a public exploit; the 'High' rating rests solely on the Chromium severity assessment.
Medium
EPSS
0%
NEW A3
0 CVE-2026-91747
Beyond the patch information, the alert provides no indication of active exploitation, attacker TTPs, or affected sectors.
Medium
EPSS
0%
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
17 NEW A2
95 CVE-2023-45858
Beyond the plain patch information, the alert provides no evidence of active exploitation; the flaw allows reading local files and is fixed in version 23.4.88.1429.
Critical
CVSS
8.6
EPSS
0%
NEW Sandworm C3
85 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The GRU actor Sandworm is chaining Cisco vulnerabilities to spread an upgraded Cyclops Blink variant and maintain persistent control over compromised network devices.
Critical
HoneyMyte B3
82 APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
The use of a signed kernel driver as a rootkit shows the group is deliberately bypassing EDR detection on Windows endpoints and servers, not merely exfiltrating data.
Critical
UAT-10147 B3
80 UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
For the first time, an APT actor is documented systematically using agentic AI tooling (playbooks, exploit automation, payload generation) across the entire post-compromise lifecycle, significantly increasing the speed and scalability of intrusions.
Critical
NEW A2
76 CVE-2023-28148
The report provides no information beyond the patch details about active exploitation or new attack vectors.
Critical
CVSS
7.2
EPSS
0%
NEW A2
74 CVE-2026-85921
The report provides no information beyond the plain CVE description; there is no indication of active exploitation, a PoC, or threat actors.
High
CVSS
8.2
EPSS
0%
NEW A2
71 CVE-2026-85892
Beyond the pure patch information, the report provides no indications of active exploitation, threat actor groups, or affected victim sectors.
High
CVSS
7.8
EPSS
0%
NEW A2
30 CVE-2023-22631
Beyond the plain patch information, the report adds no new insight: there is no indication of active exploitation, nor any details on TTPs or affected sectors.
Low
CVSS
2.7
EPSS
0%
UAT-10147 B3
15 UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
The combination of a Linux kernel rootkit, BYOVD EDR neutralisation and cross-platform C2 in a single, widely deployed implant shows that kernel-level evasion techniques are no longer reserved for top-tier state actors.
High
NEW C3
0 ClickFix Campaigns Abuse Legitimate Services for Persistent Access
ClickFix campaigns use legitimate system services for persistent attacks and therefore require user awareness rather than pure patch management.
Medium
NEW A3
0 Microsoft Edge: Vulnerability allows Cross-Site Scripting
Medium
A3
0 [UPDATE] 7-Zip: Vulnerability allows bypassing security restrictions
Medium
NEW A3
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities
The report does not provide specific CVE IDs or attack details, so the actual exposure and urgency remain unclear.
Medium
NEW A3
0 [UPDATE] Google Chrome/Microsoft Edge: Multiple Vulnerabilities
Medium
NEW A3
0 UPDATE: Paessler PRTG: Vulnerability Allows Information Disclosure
The vulnerability in Paessler PRTG allows information disclosure, which can compromise the confidentiality of monitoring data.
Medium
NEW A3
0 [UPDATE] Paessler PRTG: Multiple Vulnerabilities
Medium
NEW A3
0 [UPDATE] OpenSSH: Multiple Vulnerabilities
Medium