Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
A look into Anthropic Glasswing's latest update to their vulnerability disclosure ledger.
First reported Sep 08, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through a borrowed admin session, into remote code execution.
First reported Sep 30, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck is committed to accelerating visibility and improving data quality for defenders. We support the CVE Program and continue to expand our contributions by assigning CVE IDs to vulnerabilities observed by, discovered by, or reported to VulnCheck.
First reported Dec 02, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordAn analysis of React2Shell variants, public exploits, paths to RCE, and implications for detection and response
First reported Dec 08, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordKey Trends and Findings from Known Exploited Vulnerabilities, AI discovered vulnerabilities, and AI targeted technologies from the first half of 2026
First reported Jul 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck treats every CVE as a forever-day, because we know exploitation doesn’t adhere to timelines or maintenance cycles.
First reported Apr 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordBuilding a complete SharePoint exploit chain to get unauthenticated RCE via unsafe .NET type instantiation.
First reported Aug 24, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Command & Control (C2) Infrastructure
First reported Apr 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWhat began as one attacker exploiting CVE-2025-24893 has become a multi-actor scramble including botnets, miners, and custom tooling. Our early Canary detections show how quickly real-world exploitation now evolves.
First reported Nov 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck’s Initial Access Intelligence team has been tracking and analyzing half a dozen recent vulnerabilities in Cisco Catalyst SD-WAN Manager, several of which have begun to see in-the-wild exploitation. Industry focus has been on CVE-2026-20127, but several other vulnerabilities also pose significant risk.
First reported Mar 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team analyzes React2Shell CVE-2025-55182 exploitability in frameworks that utilize the vulnerable components outside of Next.js alone, with emphasis on exploitation steps and potential fingerprinting paths.
First reported Dec 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's new update enhances our CVE pages bringing actionable threat intelligence to the forefront.
First reported Jan 30, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordTwenty router models sold on Amazon, AliExpress, and Alibaba ship with a remote-control implant enabled by default. It runs as root, it uses no encryption, and it authenticates nobody. Whoever answers the phone owns the device.
First reported Aug 05, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis integration brings VulnCheck’s exploit-centric vulnerability intelligence directly into ThreatQ, enabling joint customers to supercharge threat operations, vulnerability prioritization, and incident response with real-world exploit data.
First reported Jul 02, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck offers a free vulnerability reporting service designed to reduce the burden of disclosure and support researchers.
First reported Jan 09, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Initial Access Exploits
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCanary Intelligence linked exploitation of CVE-2023-46604, CVE-2023-38646, and CVE-2025-55182 to the same Kinsing infrastructure, including a shared staging host and attacker IP first seen in the canary network on March 12, 2026. The research shows how an older malware family is still adapting by adding new exploit paths while continuing to rely on established infrastructure.
First reported Mar 26, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck researchers spotted a novel use of the "mount" command in real-world exploitation of Hikvision CVE-2021-36260. The attacker used NFS to drop and execute binaries, bypassing traditional download methods and evading common detection signatures. This technique has since been integrated into VulnCheck’s open-source go-exploit framework.
First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's inaugural THREATCON1 event brought together hundreds of cybersecurity professionals for a groundbreaking conference focused on emerging threats and innovative solutions.
First reported Oct 06, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordInsights on emerging threats, VulnCheck-observed exploitation in the wild, and published CVEs from VulnCheck’s research teams
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCreating a language-native .NET source for deserialization gadgets
First reported Nov 12, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck’s research team shares GitHub exploit trends and other lessons learned from reviewing thousands of exploit PoCs.
First reported Aug 20, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck observed in-the-wild exploitation of CVE-2025-11953 targeting exposed React Native Metro servers shortly after public disclosure. Analysis of repeated attacks shows consistent, operational payload delivery rather than opportunistic scanning. This post examines how the vulnerability was exploited and why early exploitation visibility matters for defenders.
First reported Feb 03, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExpanding VulnCheck’s KEV: Auditing ShadowServer, New CVE Assignments, and Source Expansion
First reported Jul 10, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.