Threat Landscape

Real-time data from CISA and NIST demonstrates why continuous information security is not optional — it is a necessity.

Global threat activity

Real-time data from multiple open threat databases shows where cyber attacks originate and how they target European countries.

Attack traffic (SANS)
Malware C2 (ThreatFox)
Blocklist (Blocklist.de)
Malware distribution (URLhaus)
Compromised (ET)
Known threats (CI Army)
European targets

Threat source summary

Aggregated statistics from the six threat databases visualised on the map.

Threat sources – geographic spread

Attack traffic (SANS)
825,848,406 indicators · 30 countries
Blocklist (Blocklist.de)
94 indicators · 25 countries
Compromised (ET)
100 indicators · 22 countries
Known threats (CI Army)
100 indicators · 22 countries
Malware C2 (ThreatFox)
100 indicators · 19 countries
Malware distribution (URLhaus)
100 indicators · 13 countries

Top 5 source countries

1United States
252,213,995
2Netherlands
79,416,175
3Bulgaria
77,968,951
4Turkey
53,350,492
5France
41,306,361

Total indicator count aggregated across all sources.

1,612

Actively exploited vulnerabilities

25

New in the last 30 days

1,666

New CVEs in the last 7 days

7

Critical (CVSS 9.0+)

44

High (CVSS 7.0–8.9)

Vendors with active remediation deadlines

SolarWinds 1 active vulnerabilities
Mirasvit 1 active vulnerabilities
Linux 1 active vulnerabilities
Android 1 active vulnerabilities
Nx 1 active vulnerabilities

Ransomware share

20%
Ransomware-linked
Unknown link

325 / 1,612

Critical CVEs in the last 7 days

The five most severe new vulnerabilities with a CVSS score of 9.0 or higher.

9.8
CVE-2026-44649

29 May 2026

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18....

Critical
9.1
CVE-2026-44650

29 May 2026

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18....

Critical
9.9
CVE-2026-47744

29 May 2026

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Tea...

Critical
9.3
CVE-2026-9051

29 May 2026

There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to ...

Critical
9.9
CVE-2026-45372

29 May 2026

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header ...

Critical

Latest exploited vulnerabilities

CVE-2026-28318 Unknown

SolarWinds

Serv-U

5 Jun 2026

CVE-2026-45247 Unknown

Mirasvit

Mirasvit Full Page Cache Warmer

3 Jun 2026

CVE-2022-0492 Unknown

Linux

Kernel

2 Jun 2026

CVE-2025-48595 Unknown

Android

Framework

2 Jun 2026

CVE-2024-21182 Unknown

Oracle

WebLogic Server

1 Jun 2026

CVE-2026-0257 Unknown

Palo Alto Networks

PAN-OS

29 May 2026

CVE-2026-48027 Known

Nx

Nx Console

27 May 2026

CVE-2026-45321 Known

TanStack

TanStack

27 May 2026

CVE-2026-8398 Unknown

Daemon

Daemon Tools Lite

27 May 2026

CVE-2026-48172 Unknown

LiteSpeed

cPanel Plugin

26 May 2026

Why it matters

The threat landscape changes daily

The data above comes directly from the US agencies CISA and NIST. It clearly shows that new threats and vulnerabilities are discovered continuously — and that attackers are actively exploiting them.

New vulnerabilities every day

Hundreds of new CVEs are published every week. Without systematic monitoring, you risk missing critical updates.

Ransomware-linked threats are growing

A significant share of actively exploited vulnerabilities have known links to ransomware campaigns.

Regulatory requirements are tightening

NIS2 and the Cybersecurity Act require organisations to work continuously on risk management and incident preparedness.

Source: CISA Known Exploited Vulnerabilities Source: NIST National Vulnerability Database Source: SANS ISC Source: ThreatFox (abuse.ch) Source: Blocklist.de Source: URLhaus (abuse.ch) Source: Emerging Threats Source: CI Army
Last updated: 5 Jun 2026

Ready to strengthen your cybersecurity?

Book a free meeting and we will discuss how we can help your organisation meet the new requirements.

Book a meeting