Comparing 18 September 2026 with the previous day 17 September 2026.
Inclusion in the CISA KEV catalog confirms exploitation in the wild; beyond the patch information, however, no attack vectors, affected versions, or TTPs are provided.
Beyond the pure patch information, the report shows that already authenticated LDAP users can read or write arbitrary files through incorrect permission assignments in DSM , a risk for NAS-based file and backup repositories.
The vulnerability affects the SCGI module in Synology DSM and allows remote attackers to access arbitrary files and cause DoS, making it critical for exposed NAS beyond a pure patch reminder.
The report contains no indications of active exploitation or attacker TTPs and is limited to the technical description of the vulnerability.
Beyond the bare patch information, the report provides no indication of active exploitation; crucially, the attack requires valid credentials, so compromised accounts or insiders are the realistic vector.
The report contains no indication of active exploitation, proof-of-concept exploits, or attack campaigns and does not go beyond patch information.
Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system, which significantly limits practical exploitability.
The joint warning from several Western agencies, including Germany, documents a broad North Korean social engineering campaign against job seekers worldwide.
Pure patch information with no indication of active exploitation; exploitation requires a man-in-the-middle network position, so the risk depends heavily on network segmentation.
The Russian GRU actor Sandworm is exploiting Cisco vulnerabilities to spread an upgraded version of the Cyclops Blink botnet that the FBI disrupted in 2022 on network edge devices.
The report shows a China-attributed actor actively chaining zero-days in Chrome and Windows to deliver the GRIMWEDGE backdoor via spear-phishing, demonstrating that even patched flaws are exploited in the window before widespread deployment.
The report adds to patch information the insight that North Korean state actors compromise devices worldwide via fake job offers and purported crypto firms, with German authorities involved in the advisory.
The report shows that North Korean actors specifically target IT professionals via fake job offers and can thereby introduce malware into companies.
Iranian state actors use CHOSEN BRICK spyware to target dissidents, activists, and journalists; the UK and allies' exposure highlights the ongoing threat from state-sponsored espionage.
The vulnerability requires an authenticated attacker and affects the Wallpaper Path; active exploitation is not known.
The report provides no indication of active exploitation, an exploit, or a strategic campaign and does not go beyond patch information.
The report describes an SQL injection in the Sharing API of Synology DSM that allows authenticated attackers to access arbitrary shared files; beyond the pure patch information, it shows that the Sharing API is an attractive target for targeted data exfiltration.
This report describes a local privilege escalation in Microsoft Edge, without evidence of active exploitation.
The report describes only the information disclosure in the DSM Desktop API and provides no indication of active exploitation, exploit code, or attacker TTPs.
Exploitation requires physical access, which significantly reduces the risk for remotely exposed systems compared to network-based vulnerabilities.
This report contains no details beyond the pure patch information; there are no indications of active exploitation or new attack vectors.
This is a local privilege escalation via the Windows UMPDDrvPlgBlt driver that is only exploitable after prior low-privileged code execution, making it a post-exploitation escalation step in a multi-stage attack chain.
The vulnerability requires local access and has a high severity with CVSS 7.8, but there is no known active exploitation.
Exploitation requires local access with low privileges, making the vulnerability primarily relevant as an escalation path after an initial compromise.
The advisory provides no indication of active exploitation or KEV listing; exploitation requires local low-privileged code execution.
The flaw lies in Windows' IKEv2 AES-GCM decryption and is exploitable without authentication, but only on systems with specific IPsec configurations , exposure therefore depends directly on how VPN/IPsec termination is set up.
The vulnerability requires an authenticated attacker and victim interaction by clicking a sharing URL, so the exploitation risk is considerably lower than for unauthenticated RCE flaws.
Check Point Research shows that Microsoft's built-in Defender driver BTR.sys can be abused as a living-off-the-land kernel primitive and, according to MSRC, will not be patched immediately because it requires administrative privileges.
The report lists multiple kernel vulnerabilities without CVE IDs or attack details, making prioritization difficult.
The BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE IDs or indications of active exploitation.
The BSI report summarises multiple Linux kernel vulnerabilities without specific CVE details; a local attacker can escalate privileges or execute code.
The report summarises multiple vulnerabilities in Synology DSM without providing specific CVE IDs or indications of active exploitation.
The report describes three different attack paths that allowed arbitrary data to be read from Synology NAS devices; a vendor patch fixes these and other less urgent flaws.
The advisory remains unspecific and names neither CVEs nor exploitation details or an active campaign.
No changes in this category.
No changes in this category.
The use of a kernel-mode rootkit takes the CoolClient backdoor's stealth to a new level: processes, files and network connections are hidden at operating-system level from EDR and forensic tooling, significantly complicating detection and incident analysis.
The new CoolClient variant pairs a backdoor with a kernel-mode rootkit driver that hides processes, files and network connections from security tools , evidence of increasingly stealth-focused espionage toolkits.
Exploitation requires local access, so the vulnerability is primarily relevant as part of an attack chain.
An attacker on the local network can trigger a crash of processes that use glibc for name resolution via manipulated DHCP or VPN search domains.
The attack requires no prior authentication and was demonstrated as a Pwn2Own entry; there is no indication of active in-the-wild exploitation at the time of reporting.
The Pwn2Own find underscores that local privilege escalation on Windows remains a serious threat, even though no active exploitation is known.
This is a Pwn2Own-demonstrated, previously unpatched LPE vulnerability in http.sys that allows attackers who already have low-privilege access to fully take over the system.
Exploitation requires local low-privileged code execution, which reduces the risk compared to remotely exploitable vulnerabilities.
The vulnerability discovered during Pwn2Own allows local attackers with low privileges to escalate to SYSTEM via the Windows driver ipt.sys.
The vulnerabilities affect the central UniFi network management plane, which an attacker could leverage to fully compromise the management system.
The report shows that ransomware gangs deliberately use production shutdowns as leverage for extortion and as an indirect attack on the supply chain , the 40% sector trend is a strategic risk signal for manufacturing operations, not a single patch recommendation.
The BSI update does not provide CVE IDs or CVSS scores but points to systemd vulnerabilities that can allow root code execution.
The vulnerability affects the processing of XZ chunked data and requires user interaction for exploitation.
The alert is limited to the CVE description and provides no additional information about active exploitation or an attack campaign.
The report contains no information beyond the patch advisory regarding active exploitation, exploit code, or threat actors.
The report merely describes a Skia vulnerability with cross-origin data leakage; no indications of active exploitation or strategic implications.
The ZDI advisory describes a local privilege escalation in the Linux kernel (XFRM race condition) without a CVE, which already requires elevated privileges.
The report shows that even passkey- and MFA-protected cloud accounts can be compromised via social engineering, so identity-theft detection , not just authentication , must be the focus.
The BSI advisory aggregates multiple Adobe Creative Cloud vulnerabilities but provides no CVE IDs, severity scores, or indications of active exploitation.
Without CVE IDs or details on active exploitation, it remains unclear whether already known, exploited flaws are included.
The report shows that the September Patchday not only closes vulnerabilities but can also cripple domain logins,an operational risk for Windows/AD environments.
The report describes a regression in domain authentication caused by Microsoft security updates, for which a temporary workaround exists but no active exploitation is known.
The BSI advisory does not provide CVE IDs, CVSS scores, or exploitation details, so prioritization depends on the vendor patch status.
The report provides no evidence of active exploitation or strategic threat, but describes a local kernel vulnerability that requires a manipulated ext4 file system.
The vulnerability allows bypassing the read-only policy for untrusted BTF pointers in the BPF subsystem, which can lead to writes to memory that should be read-only.
The report provides no information beyond the patch regarding active exploitation, threat actors, or a strategic campaign; it is a pure kernel validation fix.
BSI aggregate advisory without specific CVE IDs, whose relevance stems mainly from the widespread use of Chrome as the default browser.
This report does not go beyond patch information; there are no indications of active exploitation, attacker TTPs, or affected sectors.
The updated BSI advisory highlights local exploitability in the Linux kernel without naming specific CVEs or active exploitation.
The updated BSI warning confirms a 7-Zip vulnerability for bypassing security restrictions, but does not provide a CVE or exploitation details.