- Home
- Threat level
- 31 October 2026
Threat level on 31 October 2026
Daily snapshot from the Blacknote live engine.
Blacknote threat level
Threat profile
Last 7 days
- 0–19Low
- 20–39Guarded
- 40–59Elevated
- 60–79High
- 80–100Severe
- Ransomware activity (weight 25%): 76 of 100, 44 victims claimed in 24 h
- Actively exploited vulnerabilities (weight 25%): 62 of 100, 10 newly exploited (7 d) · 29 critical CVEs (7 d)
- Confirmed data breaches (weight 20%): 8 of 100, 1 breaches added (7 d) · 92 incident reports (7 d)
- Official warnings (weight 15%): collecting, 0 NCSC warnings (14 d)
- Community signals (weight 15%): 94 of 100, 108 HN stories
Events that day
-
44 new victims claimed on ransomware leak sites in the last 24 hours
17 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-117656 in pow-auth (CVSS 9.3)
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an…
-
42 new victims claimed on ransomware leak sites in the last 24 hours
15 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-63377 in fctr-id (CVSS 9.8)
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to…
-
Critical vulnerability CVE-2026-78403 in Thalesgroup (CVSS 9.3)
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.…
-
Critical vulnerability CVE-2026-116241 in pgadmin.org (CVSS 9.4)
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses…
-
Critical vulnerability CVE-2026-116238 in pgadmin.org (CVSS 9.2)
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed,…
-
Critical vulnerability CVE-2026-90888 in leadsnap (CVSS 9.8)
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
-
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely…
-
Critical vulnerability CVE-2026-62849 in mqttsnet (CVSS 9.1)
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows…
-
Critical vulnerability CVE-2026-61620 in seancorfield (CVSS 9.8)
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into…
-
Critical vulnerability CVE-2026-55598 in madeofpendletonwool (CVSS 9.1)
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an…
-
Fashion retailer Resolve says hackers stole payment card information
The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment…
-
Critical vulnerability CVE-2026-119978 in FlowiseAI (CVSS 9)
Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing…
-
Critical vulnerability CVE-2026-118697 in JetBrains (CVSS 9)
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised…
-
Critical vulnerability CVE-2026-112816 in Canonical (CVSS 10)
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1…
-
Critical vulnerability CVE-2026-119717 in up9inc (CVSS 9.2)
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via…
-
Critical vulnerability CVE-2026-116852 in Marketing Fire (CVSS 9.1)
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
-
31 new victims claimed on ransomware leak sites in the last 24 hours
17 active groups. Claims are unverified; victims are not named here.
-
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in…
-
Critical vulnerability CVE-2026-119706 (CVSS 9.8)
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run…
-
Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach
The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.
-
Critical vulnerability CVE-2026-93327 in Google Cloud (CVSS 9.4)
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to…
-
Critical vulnerability CVE-2026-119660 in yincongcyincong (CVSS 9.3)
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by…
-
Critical vulnerability CVE-2026-119597 in AIDotNet (CVSS 9.3)
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge…
Indicative assessment by Blacknote Intelligence, not an official threat level. How the score works.
Archive