Threat Landscape

Real-time data from CISA and NIST demonstrates why continuous information security is not optional — it is a necessity.

Global threat activity

Real-time data from multiple open threat databases shows where cyber attacks originate and how they target European countries.

Attack traffic (SANS)
Malware C2 (ThreatFox)
Blocklist (Blocklist.de)
Malware distribution (URLhaus)
Compromised (ET)
Known threats (CI Army)
European targets

Threat source summary

Aggregated statistics from the six threat databases visualised on the map.

Threat sources – geographic spread

Attack traffic (SANS)
757,638,953 indicators · 30 countries
Blocklist (Blocklist.de)
93 indicators · 25 countries
Known threats (CI Army)
100 indicators · 23 countries
Compromised (ET)
100 indicators · 21 countries
Malware distribution (URLhaus)
100 indicators · 16 countries

Top 5 source countries

1United States
242,860,876
2Bulgaria
64,185,347
3Turkey
60,513,822
4Netherlands
53,792,572
5France
34,106,576

Total indicator count aggregated across all sources.

1,577

Actively exploited vulnerabilities

26

New in the last 30 days

1,145

New CVEs in the last 7 days

8

Critical (CVSS 9.0+)

42

High (CVSS 7.0–8.9)

Vendors with active remediation deadlines

Microsoft 6 active vulnerabilities
Cisco 3 active vulnerabilities
Adobe 2 active vulnerabilities
Kentico 1 active vulnerabilities
PaperCut 1 active vulnerabilities

Ransomware share

20%
Ransomware-linked
Unknown link

313 / 1,577

Critical CVEs in the last 7 days

The five most severe new vulnerabilities with a CVSS score of 9.0 or higher.

9.8
CVE-2025-63939

14 Apr 2026

Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.

Critical
9.8
CVE-2025-65133

14 Apr 2026

A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the aff...

Critical
9.8
CVE-2025-65135

14 Apr 2026

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.

Critical
9.9
CVE-2026-38526

14 Apr 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

Critical
9.8
CVE-2026-39808

14 Apr 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized co...

Critical

Latest exploited vulnerabilities

CVE-2026-20122 Unknown

Cisco

Catalyst SD-WAN Manger

20 Apr 2026

CVE-2026-20133 Unknown

Cisco

Catalyst SD-WAN Manager

20 Apr 2026

CVE-2025-2749 Unknown

Kentico

Kentico Xperience

20 Apr 2026

CVE-2023-27351 Unknown

PaperCut

NG/MF

20 Apr 2026

CVE-2025-48700 Unknown

Synacor

Zimbra Collaboration Suite (ZCS)

20 Apr 2026

CVE-2026-20128 Unknown

Cisco

Catalyst SD-WAN Manager

20 Apr 2026

CVE-2025-32975 Unknown

Quest

KACE Systems Management Appliance (SMA)

20 Apr 2026

CVE-2024-27199 Unknown

JetBrains

TeamCity

20 Apr 2026

CVE-2026-34197 Unknown

Apache

ActiveMQ

16 Apr 2026

CVE-2009-0238 Unknown

Microsoft

Office

14 Apr 2026

Why it matters

The threat landscape changes daily

The data above comes directly from the US agencies CISA and NIST. It clearly shows that new threats and vulnerabilities are discovered continuously — and that attackers are actively exploiting them.

New vulnerabilities every day

Hundreds of new CVEs are published every week. Without systematic monitoring, you risk missing critical updates.

Ransomware-linked threats are growing

A significant share of actively exploited vulnerabilities have known links to ransomware campaigns.

Regulatory requirements are tightening

NIS2 and the Cybersecurity Act require organisations to work continuously on risk management and incident preparedness.

Source: CISA Known Exploited Vulnerabilities Source: NIST National Vulnerability Database Source: SANS ISC Source: ThreatFox (abuse.ch) Source: Blocklist.de Source: URLhaus (abuse.ch) Source: Emerging Threats Source: CI Army
Last updated: 21 Apr 2026

Ready to strengthen your cybersecurity?

Book a free meeting and we will discuss how we can help your organisation meet the new requirements.

Book a meeting