Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 2 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded.You know the drill - it’s the typical enterprise “please don’t be
First reported Aug 14, 2026 07:08 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIt is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.While we’ve seemingly had a breather from
First reported Jun 12, 2026 05:17 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordToday, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055? While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately identify exploitable
First reported Mar 29, 2026 20:07 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordPart 1 of this week's saga can be found here.This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerging threats: the watchTowr Platform.What Is A Citrix NetScaler?NetScaler, from Citrix (now under Cloud
First reported Sep 29, 2026 13:55 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThree posts? In three days? Are we insane?We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk. On June 10th, Splunk published this CVE-2026-20253 advisory:It has everything that we
First reported Jun 12, 2026 20:35 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIf you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent
First reported Apr 02, 2026 10:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordGod damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world apparently knew about Citrix NetScaler CVEs before Citrix had woken up
First reported Sep 28, 2026 10:55 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWelcome back to yet another episode of "security was taken seriously".Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design”
First reported Oct 06, 2026 17:01 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordSequels? Pain? We're obviously talking about Citrix NetScalers, yet again.Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.If you asked a C programmer what they most dislike doing in life, their answer might
First reported Mar 28, 2026 20:39 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWe’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working.Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to have confidence
First reported Jul 02, 2026 16:38 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordHello! Yes, it's all a disaster again! Let's get this party started: No comments today, so imagine this:We wrote something that we find very funny,Nobody else gets it,But everyone humors us Just like a typical watchTowr Labs blog introduction.As with all watchTowr
First reported Apr 29, 2026 17:19 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordToday, Ivanti published an advisory.“No way?” we hear you say. "Yes way!"Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities.CVE-2026-10520An OS Command Injection
First reported Jun 10, 2026 00:52 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWell, well, well - once again, the cat has dragged us in and spat us out.Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”Well, if you’re here, you likely fit
First reported Jun 30, 2026 19:35 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWell, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry.We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas (apparently?) are now using LLMs to find and reproduce vulnerabilities - it’
First reported Sep 23, 2026 23:19 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordNew CVE-2025-2611 attacks led us to a selective exploitation tool named frost that only fires when targets match precise fingerprints. VulnCheck's Canary Intelligence, EVI, and IP Intel exposed the CVEs involved, the operator's infrastructure, and the internet-exposed systems they can reach.
First reported Dec 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA common topic that’s been brought to my attention on several occasions is the perceived increase in vulnerabilities deemed “Critical” by their CVSS severity. According to FIRST, CVSS severity ratings are intended to help organizations assess and prioritize vulnerability management efforts. With this in mind, I set out to explore CVSS severity trends over time, which ultimately led me to examine t
First reported Dec 15, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck tracked thousands of attacker systems over a 90-day window to see how long malicious infrastructure really lasts. The results show that exposure doesn’t mean disruption, as many phishing kits, proxies, and C2 tools stay online for weeks or even months.
First reported Jul 31, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploring an unauthenticated remote code execution in the SmarterTools SmarterMail server via the ConnectToHub mounting functionality.
First reported Jan 26, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA new critical vulnerability was disclosed in Fortra's GoAnywhere managed file transfer product, which has been targeted in the past by ransomware and extortion groups
First reported Sep 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordInstead of bouncing between tabs, you now get instant, current context the moment a CVE appears on your screen.
First reported Sep 08, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordRecent disclosures around two recent Linux LPEs Copy Fail and Dirty Frag discovered with the assistance of AI have exposed a broader class of Linux kernel local privilege escalation vulnerabilities involving page-cache overwrite primitives. This analysis separates the technical reality from the noisy wave of AI-generated disclosures and recycled proofs of concept
First reported Jun 11, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordForrester’s recent blog by Eric Nost, Mitregeddon Averted, But Fragility in CVE Processes Remain, shines a much-needed spotlight on the systemic challenges facing the CVE and NVD ecosystem from the industry analyst perspective.
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordAttackers are abusing an unauthenticated command injection bug in ICTBroadcast (CVE-2025-2611) to execute remote commands and drop reverse shells. VulnCheck caught the exploitation, linked it to related research, and had detections available for customers well before the activity began.
First reported Oct 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Proof-of-Concept
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.