Threat Landscape

Real-time data from CISA and NIST demonstrates why continuous information security is not optional — it is a necessity.

Global threat activity

Real-time data from multiple open threat databases shows where cyber attacks originate and how they target European countries.

Attack traffic (SANS)
Malware C2 (ThreatFox)
Blocklist (Blocklist.de)
Malware distribution (URLhaus)
Compromised (ET)
Known threats (CI Army)
European targets

Threat source summary

Aggregated statistics from the six threat databases visualised on the map.

Threat sources – geographic spread

Attack traffic (SANS)
757,550,030 indicators · 30 countries
Blocklist (Blocklist.de)
97 indicators · 25 countries
Known threats (CI Army)
99 indicators · 25 countries
Malware C2 (ThreatFox)
100 indicators · 21 countries
Compromised (ET)
100 indicators · 21 countries
Malware distribution (URLhaus)
100 indicators · 16 countries

Top 5 source countries

1United States
242,839,015
2Bulgaria
64,185,078
3Turkey
60,509,810
4Netherlands
53,789,671
5France
34,104,631

Total indicator count aggregated across all sources.

1,577

Actively exploited vulnerabilities

26

New in the last 30 days

1,156

New CVEs in the last 7 days

10

Critical (CVSS 9.0+)

24

High (CVSS 7.0–8.9)

Vendors with active remediation deadlines

Microsoft 6 active vulnerabilities
Cisco 3 active vulnerabilities
Adobe 2 active vulnerabilities
Kentico 1 active vulnerabilities
PaperCut 1 active vulnerabilities

Ransomware share

20%
Ransomware-linked
Unknown link

313 / 1,577

Critical CVEs in the last 7 days

The five most severe new vulnerabilities with a CVSS score of 9.0 or higher.

9.1
CVE-2025-8095

14 Apr 2026

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applicat...

Critical
9.8
CVE-2026-31049

14 Apr 2026

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field

Critical
9.8
CVE-2025-61260

14 Apr 2026

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a ...

Critical
9.8
CVE-2025-63939

14 Apr 2026

Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.

Critical
9.8
CVE-2025-65133

14 Apr 2026

A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the aff...

Critical

Latest exploited vulnerabilities

CVE-2026-20122 Unknown

Cisco

Catalyst SD-WAN Manger

20 Apr 2026

CVE-2026-20133 Unknown

Cisco

Catalyst SD-WAN Manager

20 Apr 2026

CVE-2025-2749 Unknown

Kentico

Kentico Xperience

20 Apr 2026

CVE-2023-27351 Unknown

PaperCut

NG/MF

20 Apr 2026

CVE-2025-48700 Unknown

Synacor

Zimbra Collaboration Suite (ZCS)

20 Apr 2026

CVE-2026-20128 Unknown

Cisco

Catalyst SD-WAN Manager

20 Apr 2026

CVE-2025-32975 Unknown

Quest

KACE Systems Management Appliance (SMA)

20 Apr 2026

CVE-2024-27199 Unknown

JetBrains

TeamCity

20 Apr 2026

CVE-2026-34197 Unknown

Apache

ActiveMQ

16 Apr 2026

CVE-2009-0238 Unknown

Microsoft

Office

14 Apr 2026

Why it matters

The threat landscape changes daily

The data above comes directly from the US agencies CISA and NIST. It clearly shows that new threats and vulnerabilities are discovered continuously — and that attackers are actively exploiting them.

New vulnerabilities every day

Hundreds of new CVEs are published every week. Without systematic monitoring, you risk missing critical updates.

Ransomware-linked threats are growing

A significant share of actively exploited vulnerabilities have known links to ransomware campaigns.

Regulatory requirements are tightening

NIS2 and the Cybersecurity Act require organisations to work continuously on risk management and incident preparedness.

Source: CISA Known Exploited Vulnerabilities Source: NIST National Vulnerability Database Source: SANS ISC Source: ThreatFox (abuse.ch) Source: Blocklist.de Source: URLhaus (abuse.ch) Source: Emerging Threats Source: CI Army
Last updated: 21 Apr 2026

Ready to strengthen your cybersecurity?

Book a free meeting and we will discuss how we can help your organisation meet the new requirements.

Book a meeting