Comparing 18 September 2026 with the previous day 11 September 2026.
Inclusion in the CISA KEV catalog confirms exploitation in the wild; beyond the patch information, however, no attack vectors, affected versions, or TTPs are provided.
Beyond the pure patch information, the report shows that already authenticated LDAP users can read or write arbitrary files through incorrect permission assignments in DSM , a risk for NAS-based file and backup repositories.
The vulnerability affects the SCGI module in Synology DSM and allows remote attackers to access arbitrary files and cause DoS, making it critical for exposed NAS beyond a pure patch reminder.
The report contains no indications of active exploitation or attacker TTPs and is limited to the technical description of the vulnerability.
Beyond the bare patch information, the report provides no indication of active exploitation; crucially, the attack requires valid credentials, so compromised accounts or insiders are the realistic vector.
The report contains no indication of active exploitation, proof-of-concept exploits, or attack campaigns and does not go beyond patch information.
Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system, which significantly limits practical exploitability.
The joint warning from several Western agencies, including Germany, documents a broad North Korean social engineering campaign against job seekers worldwide.
Pure patch information with no indication of active exploitation; exploitation requires a man-in-the-middle network position, so the risk depends heavily on network segmentation.
The Russian GRU actor Sandworm is exploiting Cisco vulnerabilities to spread an upgraded version of the Cyclops Blink botnet that the FBI disrupted in 2022 on network edge devices.
The report shows a China-attributed actor actively chaining zero-days in Chrome and Windows to deliver the GRIMWEDGE backdoor via spear-phishing, demonstrating that even patched flaws are exploited in the window before widespread deployment.
The report adds to patch information the insight that North Korean state actors compromise devices worldwide via fake job offers and purported crypto firms, with German authorities involved in the advisory.
The report shows that North Korean actors specifically target IT professionals via fake job offers and can thereby introduce malware into companies.
Iranian state actors use CHOSEN BRICK spyware to target dissidents, activists, and journalists; the UK and allies' exposure highlights the ongoing threat from state-sponsored espionage.
The vulnerability requires an authenticated attacker and affects the Wallpaper Path; active exploitation is not known.
The report provides no indication of active exploitation, an exploit, or a strategic campaign and does not go beyond patch information.
The report describes an SQL injection in the Sharing API of Synology DSM that allows authenticated attackers to access arbitrary shared files; beyond the pure patch information, it shows that the Sharing API is an attractive target for targeted data exfiltration.
This report describes a local privilege escalation in Microsoft Edge, without evidence of active exploitation.
The report describes only the information disclosure in the DSM Desktop API and provides no indication of active exploitation, exploit code, or attacker TTPs.
Exploitation requires physical access, which significantly reduces the risk for remotely exposed systems compared to network-based vulnerabilities.
This report contains no details beyond the pure patch information; there are no indications of active exploitation or new attack vectors.
This is a local privilege escalation via the Windows UMPDDrvPlgBlt driver that is only exploitable after prior low-privileged code execution, making it a post-exploitation escalation step in a multi-stage attack chain.
The vulnerability requires local access and has a high severity with CVSS 7.8, but there is no known active exploitation.
Exploitation requires local access with low privileges, making the vulnerability primarily relevant as an escalation path after an initial compromise.
The advisory provides no indication of active exploitation or KEV listing; exploitation requires local low-privileged code execution.
The flaw lies in Windows' IKEv2 AES-GCM decryption and is exploitable without authentication, but only on systems with specific IPsec configurations , exposure therefore depends directly on how VPN/IPsec termination is set up.
The vulnerability requires an authenticated attacker and victim interaction by clicking a sharing URL, so the exploitation risk is considerably lower than for unauthenticated RCE flaws.
Check Point Research shows that Microsoft's built-in Defender driver BTR.sys can be abused as a living-off-the-land kernel primitive and, according to MSRC, will not be patched immediately because it requires administrative privileges.
The report lists multiple kernel vulnerabilities without CVE IDs or attack details, making prioritization difficult.
The BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE IDs or indications of active exploitation.
The BSI report summarises multiple Linux kernel vulnerabilities without specific CVE details; a local attacker can escalate privileges or execute code.
The report summarises multiple vulnerabilities in Synology DSM without providing specific CVE IDs or indications of active exploitation.
The report describes three different attack paths that allowed arbitrary data to be read from Synology NAS devices; a vendor patch fixes these and other less urgent flaws.
The advisory remains unspecific and names neither CVEs nor exploitation details or an active campaign.
No changes in this category.
No changes in this category.
The alert provides no details on active exploitation, affected versions, or patch urgency , it is a generic patch announcement without context on threat activity or deployment timeline.
Sensitive information hardcoded in source code allows unauthorized access to FortiMonitor instances; vague attack vector details suggest incomplete CVE documentation.
No additional strategic information beyond patch announcement available; merely technical CVE classification without context of active exploits or campaigns.
The vulnerability requires user interaction to upload a malicious driver and is not documented in active attack scenarios to date.
APT29 leverages generative AI systems to automate malware regeneration after detection, undermining static detection mechanisms, and compromises supply-chain infrastructure (hospitality vendors) for network manipulation.
Russian state-linked actors are weaponizing commercial AI tools like Claude for targeted cyber-espionage against Western government and defense organizations, signaling strategic escalation of hybrid warfare with DACH implications.
Russian state-sponsored hacker groups directly targeted AI vendor infrastructure and leveraged Claude to automate malware evasion techniques, signaling a new attack model against cloud service providers and their customers.
Pure vulnerability report with no indication of active exploitation, PoC, or attacker TTPs.
The flaw is only exploitable on systems with the WDS role enabled, so the effective attack surface depends heavily on role configuration, and no patch is yet confirmed.
The flaw was demonstrated at Pwn2Own; it allows bypassing the existing authentication mechanism and thereby escalating privileges on Exchange servers, despite authentication being nominally required.
The vulnerability was demonstrated as a zero-day at Pwn2Own and allows unauthenticated bypass of Exchange authentication , an indication that patches may only become available with a delay.
This is a kernel LPE in win32kfull demonstrated at Pwn2Own, with no patch status communicated yet, which combined with an initial-access vector enables full system compromise.
The advisory highlights ICC color profiles as an attack vector for remote code execution on Windows; exploitation requires interaction with the color management library.
The flaw was demonstrated at Pwn2Own and allows an attacker who already has local code execution to escalate privileges on Windows systems; public exploit code is therefore fundamentally likely.
The vulnerability was demonstrated at Pwn2Own, indicating an available exploit; a local attacker with low privileges can gain system privileges.
The Pwn2Own finding demonstrates exploitability of the local privilege escalation in ipt.sys; active exploitation is not known.
The BSI has documented critical and zero-day vulnerabilities in Microsoft SharePoint without providing specific CVE identifiers or details on active exploitation , indicating a general security advisory without active-campaign context.
BSI warns of critical code execution vulnerability in multiple Microsoft Office versions triggered by Use-After-Free, requiring immediate patches.
Attackers use invisible Unicode characters to split financial lure words and bypass modern email filters,representing an evolution of AI-era evasion techniques into large-scale traditional phishing campaigns.
Heise reports on SAP patch day with multiple critical vulnerabilities but does not name active attacks or exploit code; typical patch reminder reporting without evidence of wild exploitation.
A Russian threat actor group is using AI-generated exploits to automate and scale attacks against hundreds of PaperCut instances worldwide, combined with active post-exploitation for remote code execution and credential harvesting.
The BSI warns of multiple vulnerabilities in Adobe Acrobat/Reader enabling a broad range of attack scenarios, though specific CVE numbers or version details are not provided in this alert.
BSI warning regarding multiple Chrome vulnerabilities without specific CVE identification or patch-status details; typically an aggregated update advisory.
The Bluemoon exploit kit is actively used by Chinese hackers against Windows users and poses an immediate threat to manufacturing environments.
The vulnerability enables authentication bypass in PLC systems through incorrect implementation of authentication algorithms, which is particularly critical for legacy or lower application levels.
The BSI advisory describes multiple vulnerabilities in GNU libc without specific CVE numbers, which may indicate coordinated disclosure or an incompletely documented vulnerability series.
BSI advisory on systemd vulnerabilities without specification of individual CVE IDs; patch status and active exploitation remain unclear.
BSI warns of multiple Chrome vulnerabilities without full technical details; patches should be applied promptly once available.
BSI warns of multiple Intel processor vulnerabilities with high risk for local privilege escalation and data loss; specific CVE details are missing from this generic advisory.
Adobe Lightroom Classic contains multiple critical vulnerabilities (path traversal, unsafe deserialization, integer overflow, buffer overflows, authorization flaws) that can be combined to enable remote code execution.
BSI warns of multiple, partly critical vulnerabilities in Microsoft Edge with potential for code execution and data leaks; exploitation requires user interaction in some cases but remains practical.
The BSI report summarises several vulnerabilities in Ubiquiti UniFi but provides no CVE IDs or affected versions, so the vendor advisories are needed for specifics.
Attackers exploit passkey-themed phishing lures to trick users into revealing Microsoft 365 authentication credentials,a tactic that exploits modern security expectations.
There is no evidence of active exploitation, threat actors, or strategic implications; the report describes only a single kernel vulnerability with an available patch.
Pure patch information with no indication of active exploitation or strategic relevance.
The vulnerability is a local out-of-bounds write in the AppArmor parser that can be triggered via /proc/self/attr/apparmor/current, but requires loaded AppArmor profiles and has not been actively exploited so far.
The report contains no information beyond the patch details regarding active exploitation, attackers, or affected sectors.
The report contains no insights beyond patch information, as it is a pure NVD entry with no indication of active exploitation.