- Home
- Threat level
- 26 October 2026
Threat level on 26 October 2026
Daily snapshot from the Blacknote live engine.
Blacknote threat level
Threat profile
Last 7 days
- 0–19Low
- 20–39Guarded
- 40–59Elevated
- 60–79High
- 80–100Severe
- Ransomware activity (weight 25%): unavailable
- Actively exploited vulnerabilities (weight 25%): 86 of 100, 10 newly exploited (7 d) · 65 critical CVEs (7 d)
- Confirmed data breaches (weight 20%): 4 of 100, 1 breaches added (7 d) · 36 incident reports (7 d)
- Official warnings (weight 15%): collecting, 0 NCSC warnings (14 d)
- Community signals (weight 15%): 100 of 100, 115 HN stories
Events that day
-
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
-
Critical vulnerability CVE-2026-116508 (CVSS 10)
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the…
-
Critical vulnerability CVE-2026-116506 (CVSS 9.9)
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This…
-
Critical vulnerability CVE-2026-116505 (CVSS 9.1)
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file…
-
Critical vulnerability CVE-2026-116504 (CVSS 9.9)
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file…
-
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI…
-
Critical vulnerability CVE-2026-116505 in Totolink (CVSS 9.4)
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file…
-
67 new victims claimed on ransomware leak sites in the last 24 hours
16 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-10757 in Esri (CVSS 9.8)
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote…
-
Critical vulnerability CVE-2026-112346 in OpenHands (CVSS 9.3)
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and…
-
Critical vulnerability CVE-2026-10757 (CVSS 9.8)
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote…
-
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to…
-
65 new victims claimed on ransomware leak sites in the last 24 hours
15 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-112346 (CVSS 9.8)
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and…
-
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors…
-
Critical vulnerability CVE-2026-77055 in boneIO (CVSS 9.3)
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership…
-
Critical vulnerability CVE-2026-93328 in Google Cloud (CVSS 9.3)
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)…
-
Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras
CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created…
-
Critical vulnerability CVE-2026-116485 (CVSS 9.8)
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment…
-
Critical vulnerability CVE-2026-116214 (CVSS 9.1)
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any…
-
Critical vulnerability CVE-2026-65184 in Vertiv (CVSS 9.8)
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to…
-
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up…
-
Critical vulnerability CVE-2026-115693 in benoitc (CVSS 9.1)
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned…
-
Critical vulnerability CVE-2026-107656 in Fortinet (CVSS 9.6)
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0…
-
Critical vulnerability CVE-2026-59107 in WolfVision (CVSS 9.2)
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration…
Indicative assessment by Blacknote Intelligence, not an official threat level. How the score works.
Archive