NEW A2
100 CVE-2026-111585
The vulnerability is not remotely exploitable without user interaction; it requires an actively established remote-control session to a malicious or compromised host.
Critical
CVSS
8.8
EPSS
0%
What has changed?
Comparing 27 October 2026 with the previous day 26 October 2026.
Newly added
24 NEW A2
100 CVE-2026-92372
The report adds to the pure patch information the specific attack vector via crafted screen-image data or .tvs session recordings; active exploitation is not confirmed.
Critical
CVSS
8.8
EPSS
0%
NEW A2
100 CVE-2026-83831
The NVD entry only documents the vulnerability; there are no indications of active exploitation, an exploit, or an attacker.
Critical
CVSS
8.8
EPSS
0%
NEW A2
91 CVE-2026-106174
The report adds no information beyond the patch details; no active exploitation or additional attack details are documented.
Critical
CVSS
7.5
EPSS
0%
NEW C3
78 Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
An app with no permissions at all can pose as a trusted Microsoft application such as Teams and harvest sign-in tokens for work accounts , stealing valid tokens this way bypasses multi-factor authentication entirely.
Critical
CVSS
8.6
EPSS
0%
NEW A2
71 CVE-2026-92376
More than a patch note: an already locally logged-on low-privileged attacker can impersonate the IPC broker and thus obtain SYSTEM rights on the endpoint without further exploitation.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-92375
Because TeamViewer is in productive use at the company, a flaw in the IPC channel between the client and the monitoring component becomes a direct path from a standard user account to SYSTEM rights , a classic pivot after an attacker gains a first foothold on an endpoint.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-92377
The report adds attack-vector detail beyond the patch information: a locally authenticated user can load a signed executable via a forged IPC response and thereby gain SYSTEM privileges.
High
CVSS
7.8
EPSS
0%
NEW A2
66 CVE-2026-111583
Beyond the patch information, the alert shows that the installation of TeamViewer Advanced Asset Management itself introduces a local privilege-escalation risk, not only the running client.
High
CVSS
7.3
EPSS
0%
NEW A2
66 CVE-2026-111584
The alert details a local privilege escalation in TeamViewer Patch Management that requires valid local credentials and is not reported as actively exploited.
High
CVSS
7.3
EPSS
0%
B2
56 ZDI-26-673: Adobe Acrobat Pro DC Doc Object Use-After-Free Remote Code Execution Vulnerability
Beyond the patch information, the advisory provides no indication of active exploitation or a public exploit; the risk lies primarily in document-based delivery via email or the web.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-665: Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability
The vulnerability requires user interaction via a crafted PDF or web page, making it suitable for targeted phishing attacks against end users.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-667: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Exploitation requires user interaction, so crafted PDFs serve as the entry vector; the advisory provides no evidence of active exploitation.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-662: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
The vulnerability requires user interaction and is therefore classically suited for phishing campaigns using manipulated PDF documents against end users.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-664: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
The ZDI advisory documents a single vulnerability with no indication of active exploitation or KEV listing; exploitation strictly requires a user to interact with a crafted document or web page.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-663: Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution Vulnerability
Beyond patch information, the advisory provides no evidence of active exploitation; the vulnerability requires user interaction and is rated high with CVSS 7.8.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
The advisory documents a specific, highly rated Reader vulnerability requiring user interaction, with no indication of active exploitation or KEV status.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability
Because exploitation requires opening a crafted PDF or visiting a malicious page, real-world risk depends less on patch timing than on the effectiveness of mail filtering and user awareness.
Medium
CVSS
7.8
EPSS
0%
B2
51 ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability
The advisory adds little beyond patch information: it describes a local LPE in Linux kernel IPv6 multicast routing with CVSS 8.8, and does not mention active exploitation or a PoC.
Medium
CVSS
7.8
EPSS
0%
NEW A3
20 CVE-2026-112709
The alert shows that the AD connection of FortiGate firewalls itself can become an attack vector if an attacker controls the AD response traffic , that is more than a pure patch issue.
High
EPSS
0%
NEW A3
20 CVE-2026-90442
Beyond the patch information, the alert shows that an authenticated attacker with access to the Firebox management interface can potentially execute code, not just crash the certificate service.
High
EPSS
0%
NEW A3
20 CVE-2026-108141
The key point is that exploitation requires an existing Restore Operator role and controllable NAS backup contents, making it primarily relevant for compromised accounts or insiders.
High
EPSS
0%
NEW C3
17 External Teams Chats Anchor 15-Minute Malware Delivery
The report highlights a recurring attack path via external Teams chats that combines IT-support impersonation and email bombing to enable remote access and follow-on activity.
High
NEW A3
0 [UPDATE] Fortinet FortiOS: Vulnerability Allows Denial of Service
The report confirms a DoS vulnerability in FortiOS but, without a CVE ID, version details, and exploit status, does not allow a reliable prioritization.
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
20 Russian GRU C3
90 Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
The report shows that Russian GRU espionage also targets NATO-adjacent industry and law enforcement, underscoring supply-chain risk for European manufacturing.
Critical
B2
56 ZDI-26-676: Adobe Acrobat Reader DC DigSig Use-After-Free Remote Code Execution Vulnerability
The vulnerability requires user interaction and is therefore classically suited for targeted phishing campaigns using crafted PDF documents against end users.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
The flaw requires user interaction but affects a standard tool for handling external documents and thus a classic entry point for targeted attacks.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability
This is a pure ZDI advisory with no indication of active exploitation; exploitation requires a user to open a crafted DCM file.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI documents an RCE vulnerability in Adobe Photoshop that requires user interaction; there is no indication of active exploitation.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-677: Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability
The flaw lies in parsing DICOM/JPEG-LS image data, extending the attack surface of a graphics workflow to file formats that are rarely opened outside medical and technical imaging.
Medium
CVSS
7.8
EPSS
0%
B2
56 Windows Exploitation Techniques: Dangling COM Object Registrations
The post demonstrates a new Windows privilege-escalation technique via dangling COM registrations and provides a working exploit for an incomplete patch.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability
The flaw requires user interaction and has no known in-the-wild exploitation at present; it is primarily addressed by promptly patching Reader DC and Acrobat.
Medium
CVSS
7.8
EPSS
0%
NEW C3
51 Microsoft releases emergency .NET patches for critical Brotli flaw
The report highlights that the .NET Brotli vulnerability requires emergency patches but provides no indication of active exploitation or nation-state actors.
Critical
NEW C3
20 Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
The campaign shows that stolen session tokens bypass MFA and remain valid even after a password change , token revocation and Conditional Access therefore matter more than password hygiene alone.
High
A3
20 Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities
The advisory summarizes multiple vulnerabilities in Adobe Acrobat and Reader without providing new exploitation details or CVE references.
High
NEW C3
20 Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
This report reveals an active social engineering campaign via Microsoft Teams where attackers impersonate IT support to spread malware and ransomware , a direct attack vector for organizations using Teams.
High
SafePay A3
20 #StopRansomware: SafePay Ransomware
The advisory provides concrete TTPs and IOCs for SafePay ransomware and documents active double-extortion attacks that go beyond generic patch information.
High
B3
15 Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
The report highlights that manipulated AD Group Policy Objects serve as a scalable distribution mechanism for ransomware, making domain control itself an attack surface.
High
NEW B3
12 October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
The volume of 1,413 CVEs with three zero-days shows that plain patch cycles without prioritised risk assessment and fast emergency paths for critical systems are no longer sufficient.
High
A3
0 [UPDATE] OpenSSH: Multiple Vulnerabilities
OpenSSH is a critical component for remote administration; multiple vulnerabilities require timely patching even though no active exploitation is known.
Medium
A3
0 [UPDATE] Linux Kernel: Multiple Vulnerabilities
The report is an updated BSI aggregate advisory without CVE IDs or exploit status and therefore provides no reliable basis for a prioritized patching decision.
Medium
A3
0 Ubiquiti UnifiOS: Multiple Vulnerabilities
The advisory provides no CVE IDs, CVSS scores, or affected versions, which makes prioritising the UnifiOS vulnerabilities difficult.
Medium
NEW A3
0 Microsoft Edge: Vulnerability allows privilege escalation
The alert provides no CVE or exploitation details; it merely confirms a privilege escalation in Edge that should be fixed via update.
Medium
A3
0 Microsoft Edge: Multiple Vulnerabilities
Without CVE IDs, CVSS scores, or details on active exploitation, the concrete priority of the Edge vulnerabilities cannot be determined.
Medium