Comparing 1 November 2026 with the previous day 31 October 2026.
Exploiting dangling COM registrations enables local privilege escalation on Windows; a public exploit discloses technical details and makes verification of the incomplete fix necessary.
The report adds the attack vector beyond patch information: it is not the viewer that must be compromised; the remotely controlled host can attack the controlling client.
No changes in this category.
No changes in this category.
Exploitation requires user interaction, making email attachments and web downloads the primary vectors for PDF-based code execution.
The flaw resides in the DigSig component and requires user interaction; at the time of the ZDI advisory there is no indication of active exploitation, so patch status remains the decisive factor.
Exploitation requires user interaction (opening a crafted DCM file); there is no indication of active exploitation or KEV listing.
The flaw requires user interaction via a crafted image file and is therefore a typical entry vector for targeted phishing attachments at creative and design workstations.
The flaw requires user interaction but affects a widely deployed PDF reader and allows code execution in user context, so the Acrobat patch cycle should be prioritised.
The BSI advisory provides neither CVE IDs nor CVSS scores or exploitation status, so no prioritisation is possible without cross-checking the Ubiquiti vendor advisory.
The advisory bundles multiple OpenSSH vulnerabilities but provides no CVE IDs, CVSS scores, or exploitation status, complicating prioritization.
The BSI alert summarises multiple unspecified Linux kernel vulnerabilities; concrete CVE IDs, CVSS scores, or indications of active exploitation are missing.
The advisory names no specific CVE IDs or evidence of exploitation and therefore provides no information beyond routine Edge patch management.
The BSI advisory confirms multiple vulnerabilities in Adobe Creative Cloud applications but provides no CVE IDs, CVSS scores or exploitation status, which limits prioritization.
The report summarizes multiple vulnerabilities in Chrome without specifying CVEs or exploitation details, which complicates prioritization.