Comparing 2 November 2026 with the previous day 26 October 2026.
The warning indicates an ongoing targeted attack on political officeholders in Germany that goes beyond general patch information and suggests state actors as the perpetrators.
The report shows that Chinese actors are using AI-powered penetration-testing frameworks for automated attacks against hundreds of organizations, increasing the scalability of state-supported campaigns.
The report adds to patch information only the insight that exploitation requires local access and a concurrent privileged module unload, and no active campaign is known.
The report describes an attack path without any software vulnerability: help-desk impersonation over Teams combined with misconfigured AD CS certificate templates (ESC1/ESC8) leads all the way to DCSync execution on a domain controller.
The report documents an ongoing exploitation campaign: according to Volexity's analysis, the Ivanti Connect Secure attacks have been running since early October and only became widely visible through the CISA KEV listing, while Synology DSM flaws are being actively abused in parallel.
The BSI advisory aggregates multiple vulnerabilities without CVE IDs; specific CVSS scores and exploitation status remain unclear, which complicates prioritization.
The report provides no CVE ID or exploit status, which limits operational prioritization.
No changes in this category.
No changes in this category.
The report shows that Russian GRU espionage also targets NATO-adjacent industry and law enforcement, underscoring supply-chain risk for European manufacturing.
The vulnerability requires user interaction and is therefore classically suited for targeted phishing campaigns using crafted PDF documents against end users.
The flaw requires user interaction but affects a standard tool for handling external documents and thus a classic entry point for targeted attacks.
This is a pure ZDI advisory with no indication of active exploitation; exploitation requires a user to open a crafted DCM file.
ZDI documents an RCE vulnerability in Adobe Photoshop that requires user interaction; there is no indication of active exploitation.
The flaw lies in parsing DICOM/JPEG-LS image data, extending the attack surface of a graphics workflow to file formats that are rarely opened outside medical and technical imaging.
The post demonstrates a new Windows privilege-escalation technique via dangling COM registrations and provides a working exploit for an incomplete patch.
The flaw requires user interaction and has no known in-the-wild exploitation at present; it is primarily addressed by promptly patching Reader DC and Acrobat.
The report highlights that the .NET Brotli vulnerability requires emergency patches but provides no indication of active exploitation or nation-state actors.
The campaign shows that stolen session tokens bypass MFA and remain valid even after a password change , token revocation and Conditional Access therefore matter more than password hygiene alone.
The advisory summarizes multiple vulnerabilities in Adobe Acrobat and Reader without providing new exploitation details or CVE references.
This report reveals an active social engineering campaign via Microsoft Teams where attackers impersonate IT support to spread malware and ransomware , a direct attack vector for organizations using Teams.
The advisory provides concrete TTPs and IOCs for SafePay ransomware and documents active double-extortion attacks that go beyond generic patch information.
The report highlights that manipulated AD Group Policy Objects serve as a scalable distribution mechanism for ransomware, making domain control itself an attack surface.
The volume of 1,413 CVEs with three zero-days shows that plain patch cycles without prioritised risk assessment and fast emergency paths for critical systems are no longer sufficient.
OpenSSH is a critical component for remote administration; multiple vulnerabilities require timely patching even though no active exploitation is known.
The report is an updated BSI aggregate advisory without CVE IDs or exploit status and therefore provides no reliable basis for a prioritized patching decision.
The advisory provides no CVE IDs, CVSS scores, or affected versions, which makes prioritising the UnifiOS vulnerabilities difficult.
The alert provides no CVE or exploitation details; it merely confirms a privilege escalation in Edge that should be fixed via update.
Without CVE IDs, CVSS scores, or details on active exploitation, the concrete priority of the Edge vulnerabilities cannot be determined.