Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
VulnCheck's Initial Access Intelligence team analysis of CVE-2026-20079, an authentication bypass and remote code execution vulnerability in Cisco Secure Firewall Management Center.
First reported Mar 26, 2026 22:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIn our previous blog, ENDLESSDOORS Is Phoning Home. Pick up, we detailed a phone-home implant vulnerable to man-in-the-middle attacks embedded in ZBT routers. In this blog, we trace the ZBT supply chain. We got more than we bargained for.
First reported Aug 27, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordHow VulnCheck Target Intelligence makes NSA router-hygiene guidance actionable
First reported Jul 14, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThree new Citrix NetScaler vulnerabilities were disclosed on August 26, including CVE-2025-7775, a fresh zero-day flaw being used in the wild
First reported Aug 26, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordLearn how to start creating Java serialization gadgets yourself - or use VulnCheck's go-exploit library for Golang-based exploits!
First reported Feb 05, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Availability
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team analyzes a chained auth bypass and Twig SSTI in FOSSBilling that yields pre-authentication remote code execution against default installs.
First reported Jun 23, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA month after disclosure, hundreds of ScriptCase servers remain exposed and actively targeted. This post walks through finding vulnerable instances, exploiting them with just a few curl commands, and the key detection points defenders can use to stop attacks.
First reported Aug 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordOn December 3, 2025, React developers disclosed CVE-2025-55182 (React2Shell), an unauthenticated remote code execution vulnerability with a CVSS score of 10 that affects React Server Components and Next.js. This blog post provides an overview of the vulnerability, RCE path, research analysis, and recommended actions.
First reported Dec 03, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIntroducing VulnCheck Canary Intelligence, a new offering that captures real-world exploitation as it happens.
First reported Nov 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA look into Anthropic Glasswing's latest update to their vulnerability disclosure ledger.
First reported Sep 08, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through a borrowed admin session, into remote code execution.
First reported Sep 30, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck is committed to accelerating visibility and improving data quality for defenders. We support the CVE Program and continue to expand our contributions by assigning CVE IDs to vulnerabilities observed by, discovered by, or reported to VulnCheck.
First reported Dec 02, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordAn analysis of React2Shell variants, public exploits, paths to RCE, and implications for detection and response
First reported Dec 08, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordKey Trends and Findings from Known Exploited Vulnerabilities, AI discovered vulnerabilities, and AI targeted technologies from the first half of 2026
First reported Jul 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck treats every CVE as a forever-day, because we know exploitation doesn’t adhere to timelines or maintenance cycles.
First reported Apr 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordBuilding a complete SharePoint exploit chain to get unauthenticated RCE via unsafe .NET type instantiation.
First reported Aug 24, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Command & Control (C2) Infrastructure
First reported Apr 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWhat began as one attacker exploiting CVE-2025-24893 has become a multi-actor scramble including botnets, miners, and custom tooling. Our early Canary detections show how quickly real-world exploitation now evolves.
First reported Nov 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck’s Initial Access Intelligence team has been tracking and analyzing half a dozen recent vulnerabilities in Cisco Catalyst SD-WAN Manager, several of which have begun to see in-the-wild exploitation. Industry focus has been on CVE-2026-20127, but several other vulnerabilities also pose significant risk.
First reported Mar 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team analyzes React2Shell CVE-2025-55182 exploitability in frameworks that utilize the vulnerable components outside of Next.js alone, with emphasis on exploitation steps and potential fingerprinting paths.
First reported Dec 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's new update enhances our CVE pages bringing actionable threat intelligence to the forefront.
First reported Jan 30, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordTwenty router models sold on Amazon, AliExpress, and Alibaba ship with a remote-control implant enabled by default. It runs as root, it uses no encryption, and it authenticates nobody. Whoever answers the phone owns the device.
First reported Aug 05, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis integration brings VulnCheck’s exploit-centric vulnerability intelligence directly into ThreatQ, enabling joint customers to supercharge threat operations, vulnerability prioritization, and incident response with real-world exploit data.
First reported Jul 02, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.