Threat Landscape

Real-time data from CISA and NIST demonstrates why continuous information security is not optional — it is a necessity.

Global threat activity

Real-time data from multiple open threat databases shows where cyber attacks originate and how they target European countries.

Attack traffic (SANS)
Malware C2 (ThreatFox)
Blocklist (Blocklist.de)
Malware distribution (URLhaus)
Compromised (ET)
Known threats (CI Army)
European targets

Threat source summary

Aggregated statistics from the six threat databases visualised on the map.

Threat sources – geographic spread

Attack traffic (SANS)
814,153,604 indicators · 30 countries
Blocklist (Blocklist.de)
97 indicators · 25 countries
Known threats (CI Army)
99 indicators · 25 countries
Compromised (ET)
100 indicators · 22 countries
Malware C2 (ThreatFox)
100 indicators · 18 countries
Malware distribution (URLhaus)
100 indicators · 10 countries

Top 5 source countries

1United States
241,812,085
2Netherlands
106,243,711
3Bulgaria
70,194,245
4France
56,380,494
5Canada
50,787,111

Total indicator count aggregated across all sources.

1,674

Actively exploited vulnerabilities

21

New in the last 30 days

3,524

New CVEs in the last 7 days

14

Critical (CVSS 9.0+)

26

High (CVSS 7.0–8.9)

Vendors with active remediation deadlines

TrueConf 2 active vulnerabilities
Synacor 1 active vulnerabilities
MLflow 1 active vulnerabilities
Microsoft 1 active vulnerabilities

Ransomware share

21%
Ransomware-linked
Unknown link

352 / 1,674

Critical CVEs in the last 7 days

The five most severe new vulnerabilities with a CVSS score of 9.0 or higher.

9.8
CVE-2024-13784

16 Aug 2026

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted...

Critical
9.3
CVE-2026-74251

16 Aug 2026

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public...

Critical
9.8
CVE-2026-19349

16 Aug 2026

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO ses...

Critical
9.8
CVE-2026-72887

16 Aug 2026

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth ...

Critical
9.3
CVE-2026-73056

16 Aug 2026

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api....

Critical

Latest exploited vulnerabilities

CVE-2026-73570 Unknown

Synacor

Zimbra Collaboration Suite (ZCS)

21 Aug 2026

CVE-2026-72530 Unknown

TrueConf

Server

20 Aug 2026

CVE-2026-72529 Unknown

TrueConf

Server

20 Aug 2026

CVE-2026-64849 Unknown

MLflow

MLflow

19 Aug 2026

CVE-2026-33824 Unknown

Microsoft

Internet Key Exchange (IKE) Service Extensions

18 Aug 2026

CVE-2026-59310 Unknown

Broadcom

VMware vCenter

18 Aug 2026

CVE-2026-55040 Unknown

Microsoft

SharePoint

18 Aug 2026

CVE-2026-65400 Unknown

Apple

macOS

18 Aug 2026

CVE-2025-62593 Unknown

Ray-Project

Ray

17 Aug 2026

CVE-2026-20349 Unknown

Cisco

Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

11 Aug 2026

Why it matters

The threat landscape changes daily

The data above comes directly from the US agencies CISA and NIST. It clearly shows that new threats and vulnerabilities are discovered continuously — and that attackers are actively exploiting them.

New vulnerabilities every day

Hundreds of new CVEs are published every week. Without systematic monitoring, you risk missing critical updates.

Ransomware-linked threats are growing

A significant share of actively exploited vulnerabilities have known links to ransomware campaigns.

Regulatory requirements are tightening

NIS2 and the Cybersecurity Act require organisations to work continuously on risk management and incident preparedness.

Source: CISA Known Exploited Vulnerabilities Source: NIST National Vulnerability Database Source: SANS ISC Source: ThreatFox (abuse.ch) Source: Blocklist.de Source: URLhaus (abuse.ch) Source: Emerging Threats Source: CI Army
Last updated: 23 Aug 2026

Ready to strengthen your cybersecurity?

Book a free meeting and we will discuss how we can help your organisation meet the new requirements.

Book a meeting