NEW A2
100 CVE-2026-111585
The vulnerability is not remotely exploitable without user interaction; it requires an actively established remote-control session to a malicious or compromised host.
Critical
CVSS
8.8
EPSS
0%
What has changed?
Comparing 27 October 2026 with the previous day 20 October 2026.
Newly added
16 NEW A2
100 CVE-2026-92372
The report adds to the pure patch information the specific attack vector via crafted screen-image data or .tvs session recordings; active exploitation is not confirmed.
Critical
CVSS
8.8
EPSS
0%
NEW A2
100 CVE-2026-83831
The NVD entry only documents the vulnerability; there are no indications of active exploitation, an exploit, or an attacker.
Critical
CVSS
8.8
EPSS
0%
NEW A2
91 CVE-2026-106174
The report adds no information beyond the patch details; no active exploitation or additional attack details are documented.
Critical
CVSS
7.5
EPSS
0%
NEW C3
78 Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
An app with no permissions at all can pose as a trusted Microsoft application such as Teams and harvest sign-in tokens for work accounts , stealing valid tokens this way bypasses multi-factor authentication entirely.
Critical
CVSS
8.6
EPSS
0%
NEW A2
71 CVE-2026-92376
More than a patch note: an already locally logged-on low-privileged attacker can impersonate the IPC broker and thus obtain SYSTEM rights on the endpoint without further exploitation.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-92375
Because TeamViewer is in productive use at the company, a flaw in the IPC channel between the client and the monitoring component becomes a direct path from a standard user account to SYSTEM rights , a classic pivot after an attacker gains a first foothold on an endpoint.
High
CVSS
7.8
EPSS
0%
NEW A2
71 CVE-2026-92377
The report adds attack-vector detail beyond the patch information: a locally authenticated user can load a signed executable via a forged IPC response and thereby gain SYSTEM privileges.
High
CVSS
7.8
EPSS
0%
NEW A2
66 CVE-2026-111583
Beyond the patch information, the alert shows that the installation of TeamViewer Advanced Asset Management itself introduces a local privilege-escalation risk, not only the running client.
High
CVSS
7.3
EPSS
0%
NEW A2
66 CVE-2026-111584
The alert details a local privilege escalation in TeamViewer Patch Management that requires valid local credentials and is not reported as actively exploited.
High
CVSS
7.3
EPSS
0%
B2
51 ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability
The advisory adds little beyond patch information: it describes a local LPE in Linux kernel IPv6 multicast routing with CVSS 8.8, and does not mention active exploitation or a PoC.
Medium
CVSS
7.8
EPSS
0%
NEW A3
20 CVE-2026-112709
The alert shows that the AD connection of FortiGate firewalls itself can become an attack vector if an attacker controls the AD response traffic , that is more than a pure patch issue.
High
EPSS
0%
NEW A3
20 CVE-2026-90442
Beyond the patch information, the alert shows that an authenticated attacker with access to the Firebox management interface can potentially execute code, not just crash the certificate service.
High
EPSS
0%
NEW A3
20 CVE-2026-108141
The key point is that exploitation requires an existing Restore Operator role and controllable NAS backup contents, making it primarily relevant for compromised accounts or insiders.
High
EPSS
0%
NEW C3
17 External Teams Chats Anchor 15-Minute Malware Delivery
The report highlights a recurring attack path via external Teams chats that combines IT-support impersonation and email bombing to enable remote access and follow-on activity.
High
NEW A3
0 [UPDATE] Fortinet FortiOS: Vulnerability Allows Denial of Service
The report confirms a DoS vulnerability in FortiOS but, without a CVE ID, version details, and exploit status, does not allow a reliable prioritization.
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
26 NEW C3
100 ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
The report adds to the patch information that the Siemens vulnerability is already actively exploited in ClickFix campaigns to distribute a remote access Trojan.
Critical
CVSS
8.4
EPSS
0%
NEW A2
100 CVE-2026-100134
The report clarifies exploitation: code execution occurs in the user context and requires opening a crafted file; there are no indications of active exploitation.
Critical
CVSS
8.8
EPSS
0%
NEW APT28 C3
90 Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The report documents an active APT28 campaign against NATO defense suppliers using the new HOOKEDGE backdoor and a reflective loader, which goes beyond patch information as a supply-chain warning.
Critical
NEW GRU C3
90 Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
The report shows that Russian state espionage continues to target defense and aerospace suppliers as well as law enforcement agencies, increasing supply-chain pressure on European industrial companies.
Critical
A3
88 China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
The advisory shows that Western intelligence agencies are now publicly attributing state attackers from China with names and technical details , an escalation with signalling effect for all export and manufacturing companies in the DACH region.
Critical
NEW APT28 C3
80 Defense contractors in two NATO allies hacked in recent Russia-linked campaign
Russian APT28 is using a newly documented backdoor for long-term persistence in defense and law-enforcement networks, underscoring the sustained threat of espionage against European industry.
Critical
NEW SafePay C3
75 FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The joint government warning highlights SafePay as one of the most active ransomware groups and shows that attacks on businesses and critical infrastructure rely on simple access vectors such as password guessing and phishing.
Critical
B2
56 ZDI-26-676: Adobe Acrobat Reader DC DigSig Use-After-Free Remote Code Execution Vulnerability
Exploitation requires user interaction (opening a crafted file or web page), which keeps email and web vectors relevant despite the lack of a network-facing attack surface.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI reports a use-after-free flaw in Acrobat Reader DC that allows code execution after user interaction; exploit code or active exploitation is not mentioned.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability
The exploit requires opening a malicious image file; no active exploitation has been reported.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability
At the time of publication there are no signs of active exploitation; an attack requires the user to open a manipulated DCM file.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-677: Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability
This is a client-side RCE triggered by opening a manipulated image file; no active exploitation in the wild is reported.
Medium
CVSS
7.8
EPSS
0%
B2
56 Windows Exploitation Techniques: Dangling COM Object Registrations
The incomplete fix and public exploit turn the COM registration into a concrete local privilege-escalation risk that goes beyond patch information.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability
The ZDI advisory mentions neither a proof of concept nor active exploitation; the decisive factor is that simply opening a crafted PDF file is enough to achieve code execution on the endpoint.
Medium
CVSS
7.8
EPSS
0%
NEW A2
52 CVE-2026-100132
The NVD entry contains no indication of active exploitation; the risk lies in the required user interaction via malicious URLs or compromised web pages.
Medium
CVSS
4.3
EPSS
0%
NEW SafePay A3
20 #StopRansomware: SafePay Ransomware
The report shows that SafePay does not exploit a single CVE but operates as an active ransomware campaign with double extortion and exposed remote access.
High
NEW C3
17 Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
The October Patch Tuesday includes an already actively exploited zero-day and numerous critical RCE vulnerabilities, increasing the importance of timely prioritization of Microsoft patches for Windows, Exchange, and .NET systems.
High
PAYLOAD B3
15 Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
The report adds a concrete ransomware TTP beyond patch information: compromised GPOs can serve as a domain-wide payload distribution mechanism and require AD-specific security controls.
High
B3
9 ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability
The report highlights an unauthenticated information disclosure in Entra ID's OAuth device code grant that was published without a CVE ID and without known exploitation.
Medium
NEW A3
0 CVE-2026-43854
The NVD entry describes exposure of administrator credentials from encrypted project files for EdgeLink devices; there is no indication of active exploitation.
Medium
EPSS
0%
NEW A3
0 Microsoft Edge: Multiple vulnerabilities allow code execution
The alert does not name any CVE IDs or provide evidence of active exploitation; it merely describes the general possibility of code execution via manipulated files in Edge.
Medium
A3
0 Google Chrome: Multiple Vulnerabilities
The BSI advisory does not include CVE IDs or details on the individual vulnerabilities, which complicates prioritization.
Medium
A3
0 Ubiquiti UniFiOS: Multiple Vulnerabilities
The BSI advisory remains unspecific: it names neither CVE IDs nor exploitation status, so urgency can only be derived from the vendor's UniFiOS version information.
Medium
A3
0 Microsoft Edge: Multiple Vulnerabilities
Without specific CVE IDs or evidence of active exploitation, no increased priority beyond regular Edge updates can be derived from this alert.
Medium
A3
0 Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities
The report contains no CVE IDs, CVSS scores, or evidence of active exploitation; it only confirms multiple vulnerabilities in Acrobat/Reader, some of which require user interaction to exploit.
Medium
C3
0 Veeam patches malicious-code vulnerability in Backup & Replication
Beyond the patch information, the article provides no signs of active exploitation or attacker TTPs; its relevance lies in the direct exposure of the backup infrastructure.
Medium