What has changed?

CVE-2026-106193

The report only provides the CVE description; there is no evidence of active exploitation, exploit code, or attacker campaigns.

CVE-2026-106190

Beyond the patch information, the alert provides no indicators of active exploitation, victim groups, or specific attacker TTPs.

CVE-2026-106191

The vulnerability is rated only low Chromium severity and requires an already compromised renderer process, which severely limits practical exploitability.

CVE-2026-106197

CVE-2026-106194

The report describes a medium-severity Chrome sandbox escape vulnerability that requires an already compromised renderer and social engineering, but provides no evidence of active exploitation or a new attack campaign.

CVE-2026-106201

No insights beyond the patch information; no active exploitation known.

CVE-2026-106204

The report provides no information beyond patch details about active exploitation, affected campaigns, or specific attacker TTPs.

CVE-2026-106207

The report contains no insights beyond the pure patch information, in particular no indication of active exploitation or attack campaigns.

CVE-2026-106211

The report contains no information beyond the patch itself regarding active exploitation, campaigns, or specific attackers.

CVE-2026-106227

Beyond the patch information, the report provides no indications of active attacks, specific victim groups, or new TTPs; its relevance stems from the high severity of the sandbox escape vulnerability in Chrome.

CVE-2026-106248

CVE-2026-106255

Beyond the plain patch information, the report contains no indication of active exploitation, a public exploit, or an attacker campaign.

CVE-2026-106257

CVE-2026-106269

The report adds no information beyond the pure patch information; there are no indications of active exploitation or strategic relevance.

CVE-2026-106281

The report contains no details beyond patch information, such as active exploitation, exploit code, or attacker TTPs.

CVE-2026-106291

CVE-2026-106293

Beyond the patch information, the report provides no indication of active exploitation; the sandbox escape requires an already compromised renderer component.

CVE-2026-106318

Pure CVE report with no indication of active exploitation, exploit code, or attack campaign.

CVE-2026-106335

The report contains no information beyond the patch details; there is no indication of active exploitation or a strategic threat.

CVE-2026-106349

The report contains no indication of active exploitation or attacker TTPs and does not go beyond the patch information.

CVE-2026-106347

CVE-2026-106358

Beyond the pure patch information, the alert contains no indication of active exploitation, published exploits, or specific attacker TTPs.

CVE-2026-106357

The alert contains no information beyond the pure patch information regarding active exploitation, attacker TTPs, or affected sectors.

CVE-2026-106372

No insights beyond the patch information; neither active exploitation nor attack tactics are known.

CVE-2026-106374

The report provides no insights beyond the pure patch information; there are no indications of active exploitation or strategic implications.

CVE-2026-106373

CVE-2026-106382

This report contains no information beyond the patch details about active exploitation or attack campaigns.

CVE-2026-106383

The report provides no details beyond the patch information, in particular no indication of active exploitation or threat actors.

CVE-2026-106401

The report provides no indication of active exploitation, specific attackers, or TTPs and thus does not go beyond patch information.

CVE-2026-106411

This report contains no information beyond the patch information.

CVE-2026-106426

The report contains no insights beyond patch information, as neither active exploitation nor attacker TTPs are mentioned.

CVE-2026-104047

The report highlights that SSSD integration with Entra ID allows local information disclosure, which is relevant for hybrid identity environments with Linux.

CVE-2026-106182

No insights beyond the patch information.

CVE-2026-106236

Beyond the patch information, the report provides no evidence of active exploitation, campaigns, or affected sectors; the low severity rating and lack of strategic relevance make it a pure patch note.

CVE-2026-106243

No insights beyond the patch information; pure CVE description.

ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

A local LPE in the Linux kernel can enable lateral movement in multi-stage attacks.

ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

This is a Microsoft Windows local privilege escalation with a CVSS of 7.8 for which no active exploitation in the wild has been reported so far; the advisory therefore essentially provides patch-relevant information.

ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

The vulnerability only allows escalation from already obtained low privileges and is therefore primarily relevant as a link in multi-stage attack chains, not as an initial access vector.

ZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability

The vulnerability requires existing local low-privileged access, making it primarily relevant for post-exploitation scenarios and patch prioritization.

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

An unauthenticated attacker can execute code on Windows systems with specific IPsec configurations via crafted IKEv2 packets , a rare but severe attack vector against VPN endpoints.

ZDI-26-574: Linux Kernel Net Scheduler Connection Tracking Race Condition Local Privilege Escalation Vulnerability

The ZDI advisory does not mention active exploitation, and exploitation requires already high privileges, limiting practical attack value.

ZDI-26-691: Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability

The vulnerability requires high privileges, which significantly limits the exploitation risk for typical attackers without prior access.

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

The vulnerability requires local access but allows full privilege escalation in the Linux kernel; active exploitation is not known.

CVE-2026-106552

The report describes a vulnerability in OpenSSH that can lead to directory traversal during recursive SFTP copy operations; there is no indication of active exploitation.

Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

The FBI and Secret Service warning confirms that FortiBleed is not a closed incident but an ongoing campaign based on compromised firewall credentials that serves as an entry point for ransomware and targeted account lockouts.

ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

The vulnerability affects the Linux kernel network scheduler and already requires high local privileges, limiting exploitability.

Attacks on Microsoft SharePoint vulnerability

The report shows that the SharePoint flaw is not merely theoretical but is already being actively exploited, which significantly raises patching urgency.

CVE-2026-102322

Beyond the patch information, the report provides no indications of active exploitation, attacker TTPs, or affected sectors.

CVE-2026-106184

Beyond the plain patch information, the report provides no indication of active exploitation or additional attack details.

CVE-2026-106215

The report contains no evidence of active exploitation or attacker TTPs and does not go beyond patch information.

CVE-2026-106258

This report contains no information beyond the pure patch information, such as active exploitation, attack campaigns, or specific attacker TTPs.

CVE-2026-106329

CVE-2026-106332

This report contains no details beyond the pure patch information.

CVE-2026-106369

The report provides no indication of active exploitation, exploit code, or attacker campaigns and merely describes a vulnerability in Google Chrome.

CVE-2026-106376

The report contains no indication of active exploitation or new attack tactics; it merely describes a vulnerability in Chrome/ANGLE.

'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates

The technique shows that Defender updates can be blocked without stopping the service , a silent detection gap that requires no exploit.

CVE-2026-98364

Beyond patch information, the alert describes a local use-after-free vulnerability in the Linux kernel XFRM subsystem that requires a race condition and is therefore only exploitable with elevated local privileges.

BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive

Check Point shows that the Windows-built-in remediation driver BTR.sys can be abused as a LOLDriver, letting attackers with existing admin rights perform kernel operations without loading a blocklisted third-party driver.

[UPDATE] Microsoft Office: Multiple Vulnerabilities

Google Chrome: Multiple Vulnerabilities

Pure patch information without CVE or exploitation details; prioritized as a routine browser update.

CVE-2026-98223

No insights beyond patch information; it is a local kernel fix with no known active exploitation.

CVE-2026-98222

The report contains no information beyond the pure patch notice regarding active exploitation, attacker TTPs, or a strategic dimension.

[UPDATE] sudo: Vulnerability Allows Privilege Escalation

Google Chrome / Microsoft Edge: Multiple Vulnerabilities

[UPDATE] Linux Kernel: Vulnerability allows gaining administrator privileges

The report contains neither a CVE reference nor attack details, so it remains unclear which kernel versions are affected and whether an exploit is publicly known.

[UPDATE] Linux Kernel: Multiple vulnerabilities allow unspecified attack

The BSI updates its warning about multiple vulnerabilities in the Linux kernel that could allow a local attacker to cause denial of service or data manipulation.

Synology DiskStation Manager: Multiple Vulnerabilities

The BSI report aggregates several vulnerability classes in DSM without providing CVE IDs, CVSS scores or evidence of active exploitation , concrete exposure must be verified against Synology's own security advisories.

Google Chrome / Microsoft Edge: Multiple vulnerabilities allow unspecified attack

CVE-2026-106180

The report contains no indication of active exploitation, an exploit, or affected sectors and therefore does not go beyond patch information.

CVE-2026-106185

The report contains no insights beyond patch information, in particular no evidence of active exploitation or new attack techniques.

CVE-2026-106187

CVE-2026-106208

The vulnerability requires social engineering and a malicious Chrome extension, which complicates exploitation.

CVE-2026-106246

The report describes a medium-severity address bar spoofing vulnerability in Google Chrome; there is no indication of active exploitation or KEV inclusion.

CVE-2026-106244

The alert contains no indication of active exploitation or an attack campaign and does not go beyond the patch information already contained in the NVD entry.

CVE-2026-106245

The report contains no details beyond the patch information; there are no indications of active exploitation or specific attackers.

CVE-2026-106259

The report provides no insights beyond patch information; it is a single low-severity vulnerability with no indication of active exploitation.

CVE-2026-106264

No insights beyond the patch information; no active exploitation or attack details are known.

CVE-2026-106267

The report only describes a medium-severity Chrome vulnerability; exploitation requires the renderer process to already be compromised, and no active attacks are mentioned.

CVE-2026-106273

Pure patch information about a high-severity Chrome vulnerability without evidence of active exploitation or new TTPs.

CVE-2026-106280

This report contains no details beyond the patch information; there is no indication of active exploitation or specific attacker TTPs.

CVE-2026-106289

No additional information beyond the CVE description.

CVE-2026-106297

The report provides no insights beyond the pure patch information; there are no indications of active exploitation or strategic relevance.

CVE-2026-106304

The report contains no insights beyond pure patch information, as it does not mention active exploitation, attacker TTPs, or affected sectors.

CVE-2026-106322

The vulnerability requires active user interaction and only enables an origin policy bypass, which limits the risk compared to more critical flaws.

CVE-2026-106327

The report contains no information beyond the pure CVE description; there are no indications of active exploitation, attacker TTPs, or affected sectors.

CVE-2026-106330

The report contains no details beyond patch information, such as active exploitation or attacker TTPs.

CVE-2026-106333

CVE-2026-106362

No evidence of active exploitation or an attack campaign; the report merely describes a low-severity vulnerability that requires social engineering and a specially crafted Chrome extension.

CVE-2026-106363

The vulnerability requires an already compromised renderer process and social engineering, which limits exploitability; no active attacks are reported.

CVE-2026-106379

A pure vulnerability disclosure with no indication of active exploitation, proof of concept, or strategic implications.

CVE-2026-106390

The report contains no insights beyond the pure patch information; it is a single CVE report with no indication of active exploitation.

CVE-2026-106403

The report contains no indication of active exploitation, attacker TTPs, or affected sectors beyond the patch information.

CVE-2026-106415

The report provides no indication of active exploitation, exploit code, or affected targets and therefore does not go beyond pure patch information.