Threats Affecting Czech Republic

The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .

MediumVulnerabilityBelgiumFranceGermany+13

User enumeration in ESET Protect (on-prem) via Response Timing.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-3716#cwe-204

The attacks included a destructive infiltration of Poland's energy system in December and was suspected of originating in Russia. The post Poland Faced a Surge in Cyberattacks in 2025, Including a Major Assault on the Energy Sector appeared first on SecurityWeek .

MediumVulnerabilityPolandUkraineGermany+6

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

HighVulnerabilitySlovakiaCzech RepublicAustria+6#cve#cve-2026-3511#cwe-611

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.

CriticalVulnerabilityPolandGermanyAustria+8#cve#cve-2025-66956

Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.

CriticalVulnerabilityGermanyAustriaSwitzerland+7#cve#cve-2025-69615

CVE-2025-69614 is a critical vulnerability in the Deutsche Telekom AG Telekom Account Management Portal that allows unauthorized password resets via activation token reuse. This incorrect access control flaw enables attackers to bypass authentication and fully take over user accounts without any user interaction. The vulnerability affects versions prior to 2025-10-27 and was fixed on 2025-10-31. Exploitation requires no privileges and can be performed remotely over the network. The flaw stems from improper handling of password reset tokens, classified under CWE-640. Although no known exploits are currently observed in the wild, the high CVSS score of 9. 4 indicates severe risk. Organizations using this portal must urgently apply the patch to prevent account compromise and potential downstream impacts on confidentiality and integrity.

CriticalVulnerabilityGermanyAustriaSwitzerland+8#cve#cve-2025-69614

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

MediumVulnerabilityHungaryGermanyAustria+7#cve#cve-2026-27777#cwe-522

2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipulated requests, indicating improper handling of invalid input and potential security or availability impacts.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-59787#cwe-703

2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.

MediumVulnerabilityCzech RepublicGermanyUnited States+7#cve#cve-2025-59786#cwe-613