Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
CVE-2017-9841 is still a primary exploit path for several botnets. What is old is still new in the eyes of cybercrime.
First reported May 19, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordKey Trends and Findings from 2025’s Known Exploited Vulnerabilities
First reported Jan 21, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCISA recently added CVE-2025-68613, an authenticated n8n RCE, to its KEV catalog, but that framing misses how the vulnerability is actually exploited. In practice, it can be paired with CVE-2026-21858, an authentication bypass that is already being actively exploited in the wild. With over 14,000 exposed n8n instances, this attack path is both practical and widespread. The bypass enabling these ch
First reported Mar 20, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details four authenticated remote code execution vulnerabilities in FileRun, where a contact-sheet handler and a settings test endpoint run attacker input through a shell, and a delegated administrator turns a control-panel field into stacked SQL that a permission-blob deserialization weaponizes into a webshell.
First reported Sep 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck now provides automated SSVC decisions for federal and enterprise agencies.
First reported Feb 13, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordTwo new WordPress core vulnerabilities were disclosed on July 17, prompting broad concern from the security community. CVE-2026-60137 and CVE-2026-63030 are able to be chained for remote code execution against out-of-the-box WordPress installations, with multiple paths to RCE possible.
First reported Jul 17, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordInsights on recent emerging threats, initial access vulnerabilities, and published CVEs from VulnCheck’s research teams
First reported Oct 09, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWe're already seeing active React2Shell exploitation, and defenders need to know what it looks like. VulnCheck Canary Intelligence has captured real attacker probes and payloads, offering early insight into how operators are weaponizing the vulnerability. The post includes detailed examples and a list of observed IPs to support immediate defensive action.
First reported Dec 09, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordStarting from 30 days of canary hits, we used VulnCheck's new Target Intelligence product to fingerprint an attacker's fleet and map an entire credential-harvesting operation — its hardened Kubernetes cluster, its C2 panels, and the playbook it runs against victims.
First reported Jun 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an OS command injection in FileRun's thumbnail generation, where the extractors pass user-controlled filenames to exec() without shell escaping, yielding remote code execution for any authenticated user or, through a public file-request weblink, without credentials.
First reported Aug 13, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordUsing IBM's 2025 Cost of a Data Breach data, VulnCheck's 28-day speed advantage translates to $518,000 in risk avoided per incident.
First reported Feb 11, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA new Oracle E-Business Suite zero-day vulnerability is being linked to a Cl0p extortion campaign that exfiltrated EBS data from Oracle customer environments
First reported Oct 06, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck Canaries captured live exploitation of XWiki CVE-2025-24893, a vulnerability absent from CISA KEV but actively abused in the wild.
First reported Oct 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Software Dependency Graphs
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordENISA's Cyber Resilience Act Single Reporting Platform(SRP) went live September 11, 2026 so we took a look at the new reporting platform.
First reported Sep 14, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIn response to NIST NVD's announcement that it will significantly limit CVE enrichment starting April 15, 2026, VulnCheck reaffirms its commitment to filling the data gap through its free NVD++ community service and plans to expand coverage with CVSS scores over the next month
First reported Apr 16, 2026 15:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA Look into the Last 6-months of Vulnerability Exploitation… January-June 2025
First reported Jul 30, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIn Q1 2025, VulnCheck identified evidence of 159 CVEs publicly disclosed for the first time as exploited in the wild.
First reported Apr 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck integrates with OpenCTI - an open-source Threat Intelligence Platform by Filigran
First reported Mar 13, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Attacker Infrastructure
First reported Apr 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordFiligran and VulnCheck are proud to announce a strategic partnership that transforms enterprise threat intelligence capabilities through seamless integration. This collaboration brings together Filigran's market-leading OpenCTI platform with VulnCheck's comprehensive exploit intelligence solutions, creating a powerful joint offering that delivers immediate business value to security teams to enabl
First reported Mar 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated remote code execution in NVIDIA's GEN3C, where two FastAPI inference endpoints deserialize raw HTTP request bodies with pickle.loads() with no authentication.
First reported Jun 25, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordRecapping our 2025 BlackHat and Defcon experience.
First reported Aug 12, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA silently patched vulnerability (CVE-2025-64446) in Fortinet FortiWeb is being exploited in the wild to add administrative users and compromise target devices
First reported Nov 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.