Threat Landscape

Real-time data from CISA and NIST demonstrates why continuous information security is not optional — it is a necessity.

Global threat activity

Real-time data from multiple open threat databases shows where cyber attacks originate and how they target European countries.

Attack traffic (SANS)
Malware C2 (ThreatFox)
Blocklist (Blocklist.de)
Malware distribution (URLhaus)
Compromised (ET)
Known threats (CI Army)
European targets

Threat source summary

Aggregated statistics from the six threat databases visualised on the map.

Threat sources – geographic spread

Attack traffic (SANS)
537,399,487 indicators · 30 countries
Blocklist (Blocklist.de)
96 indicators · 25 countries
Malware C2 (ThreatFox)
100 indicators · 19 countries
Known threats (CI Army)
100 indicators · 18 countries
Compromised (ET)
100 indicators · 17 countries
Malware distribution (URLhaus)
100 indicators · 15 countries

Top 5 source countries

1United States
165,802,134
2Netherlands
74,363,078
3Canada
45,198,471
4France
44,356,223
5Bulgaria
43,857,746

Total indicator count aggregated across all sources.

1,748

Actively exploited vulnerabilities

32

New in the last 30 days

5,355

New CVEs in the last 7 days

3

Critical (CVSS 9.0+)

53

High (CVSS 7.0–8.9)

Vendors with active remediation deadlines

BeyondTrust 1 active vulnerabilities
Fortinet 1 active vulnerabilities

Ransomware share

21%
Ransomware-linked
Unknown link

361 / 1,748

Critical CVEs in the last 7 days

The five most severe new vulnerabilities with a CVSS score of 9.0 or higher.

9.3
CVE-2026-44828

12 Oct 2026

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard....

Critical
9.8
CVE-2026-90920

12 Oct 2026

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Critical
9.2
CVE-2026-109573

12 Oct 2026

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLA...

Critical

Latest exploited vulnerabilities

CVE-2026-102764 Unknown

BeyondTrust

Remote Support

16 Oct 2026

CVE-2025-61624 Unknown

Fortinet

Multiple Products

16 Oct 2026

CVE-2026-21589 Unknown

Atlassian

Multiple Products

15 Oct 2026

CVE-2026-105134 Unknown

Ahsay

AhsayCBS

14 Oct 2026

CVE-2026-76519 Unknown

Cisco

Secure Email Gateway

14 Oct 2026

CVE-2026-105133 Unknown

Ahsay

AhsayCBS

14 Oct 2026

CVE-2026-0322 Unknown

Palo Alto Networks

PAN-OS

14 Oct 2026

CVE-2026-104935 Unknown

Ivanti

Connect Secure

13 Oct 2026

CVE-2026-96951 Unknown

Microsoft

Windows

13 Oct 2026

CVE-2015-5477 Unknown

ISC

BIND

8 Oct 2026

Why it matters

The threat landscape changes daily

The data above comes directly from the US agencies CISA and NIST. It clearly shows that new threats and vulnerabilities are discovered continuously — and that attackers are actively exploiting them.

New vulnerabilities every day

Hundreds of new CVEs are published every week. Without systematic monitoring, you risk missing critical updates.

Ransomware-linked threats are growing

A significant share of actively exploited vulnerabilities have known links to ransomware campaigns.

Regulatory requirements are tightening

NIS2 and the Cybersecurity Act require organisations to work continuously on risk management and incident preparedness.

Source: CISA Known Exploited Vulnerabilities Source: NIST National Vulnerability Database Source: SANS ISC Source: ThreatFox (abuse.ch) Source: Blocklist.de Source: URLhaus (abuse.ch) Source: Emerging Threats Source: CI Army
Last updated: 19 Oct 2026

Ready to strengthen your cybersecurity?

Book a free meeting and we will discuss how we can help your organisation meet the new requirements.

Book a meeting