Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
In-depth analysis of 2025 CVEs and exploit trends from VulnCheck’s research team. The 2026 Exploit Intelligence Report includes an evaluation of the public exploit ecosystem, ransomware and state-sponsored threat actor deep dives, and a data-driven list of 2025’s routinely targeted vulnerabilities.
First reported Feb 25, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck identifies an unauthenticated remote code execution in the BigAnt chat server
First reported Feb 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCVE-2025-53652 was disclosed as a medium-severity vulnerability in the Jenkins Git Parameter plugin but it enables command injection and remote code execution when this popular plugin is installed. We break down the vulnerability and share detection guidance for defenders.
First reported Aug 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck provides automated SSVC decisions for federal and enterprise agencies to help address CISA BOD 26-04.
First reported Jun 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck Canary Intelligence uncovered a long-running attacker-owned OAST service operating from Google Cloud. The actor blended stock Nuclei templates with custom payloads while focusing their activity on canaries deployed in a single region. This unusual combination reveals a structured, sustained scanning operation rather than ordinary opportunistic spraying.
First reported Nov 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCisco Catalyst SD-WAN vManager's login module and application server disagree about whether a request path has been URL-decoded yet. That single percent-encoded character gives us CVE-2026-76504. One unauthenticated POST with an arbitrary password triggers a critical authentication bypass that gives an attacker admin-level access to the entire SD-WAN fabric.
First reported Oct 01, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis quarter was a defining one for VulnCheck — not just in numbers, but in what those numbers represent and how critical VulnCheck is in both enriching cyber products in the market and protecting our global economy and national security.
First reported Oct 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding APTs
First reported Apr 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck reviewed the full wave of React2Shell exploits published on GitHub, discarding about half as broken or misleading and surfacing several genuinely interesting techniques from the rest. We curated the usable set, highlighted the notable variants, and made the entire approved dataset freely available in VulnCheck's Exploit Database (XDB).
First reported Dec 12, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis research aims to share experiences and observations to help others better understand how ENISA EUVD compares with existing vulnerability sources and whether it can serve as a reliable alternative for these established services.
First reported May 20, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordFortinet disclosed two critical vulnerabilities on December 9 that arise from improper cryptographic signature verification and enable remote attackers to bypass SSO login on vulnerable devices. The vulnerabilities are being exploited in the wild.
First reported Dec 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Maturity
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck and partner GreyNoise discovered Zyxel-related vulnerabilities being targeted in the wild. In this blog, VulnCheck describes the vulnerabilities CVE-2024-40891 and CVE-2025-0890.
First reported Feb 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWhat’s really being targeted at the network edge? VulnCheck’s 2026 research shows that a significant portion of exploited vulnerabilities affect end-of-life devices, with consumer networking equipment and botnets driving much of the activity. This report breaks down the trends shaping real-world exploitation.
First reported Mar 23, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team analysis of CVE-2026-20079, an authentication bypass and remote code execution vulnerability in Cisco Secure Firewall Management Center.
First reported Mar 26, 2026 22:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIn our previous blog, ENDLESSDOORS Is Phoning Home. Pick up, we detailed a phone-home implant vulnerable to man-in-the-middle attacks embedded in ZBT routers. In this blog, we trace the ZBT supply chain. We got more than we bargained for.
First reported Aug 27, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordHow VulnCheck Target Intelligence makes NSA router-hygiene guidance actionable
First reported Jul 14, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThree new Citrix NetScaler vulnerabilities were disclosed on August 26, including CVE-2025-7775, a fresh zero-day flaw being used in the wild
First reported Aug 26, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordLearn how to start creating Java serialization gadgets yourself - or use VulnCheck's go-exploit library for Golang-based exploits!
First reported Feb 05, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Availability
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team analyzes a chained auth bypass and Twig SSTI in FOSSBilling that yields pre-authentication remote code execution against default installs.
First reported Jun 23, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA month after disclosure, hundreds of ScriptCase servers remain exposed and actively targeted. This post walks through finding vulnerable instances, exploiting them with just a few curl commands, and the key detection points defenders can use to stop attacks.
First reported Aug 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordOn December 3, 2025, React developers disclosed CVE-2025-55182 (React2Shell), an unauthenticated remote code execution vulnerability with a CVSS score of 10 that affects React Server Components and Next.js. This blog post provides an overview of the vulnerability, RCE path, research analysis, and recommended actions.
First reported Dec 03, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIntroducing VulnCheck Canary Intelligence, a new offering that captures real-world exploitation as it happens.
First reported Nov 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.