Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
In our previous blog, ENDLESSDOORS Is Phoning Home. Pick up, we detailed a phone-home implant vulnerable to man-in-the-middle attacks embedded in ZBT routers. In this blog, we trace the ZBT supply chain. We got more than we bargained for.
First reported Aug 27, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordWe're already seeing active React2Shell exploitation, and defenders need to know what it looks like. VulnCheck Canary Intelligence has captured real attacker probes and payloads, offering early insight into how operators are weaponizing the vulnerability. The post includes detailed examples and a list of observed IPs to support immediate defensive action.
First reported Dec 09, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordAn examination of vulnerabilities affecting Xiongmai IoT devices, including exploit development and an analysis of exploitation in the wild.
First reported Nov 30, 2022 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordA Look into the Last 6-months of Vulnerability Exploitation… January-June 2024
First reported Aug 05, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordLate last week, chat logs from Black Basta became available, offering rare insight into the operations of one of the most infamous ransomware groups. This research focuses on the vulnerabilities and CVEs mentioned in these logs, with the goal of providing defenders with actionable intelligence on the tactics of Black Basta.
First reported Feb 24, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck tracked thousands of attacker systems over a 90-day window to see how long malicious infrastructure really lasts. The results show that exposure doesn’t mean disruption, as many phishing kits, proxies, and C2 tools stay online for weeks or even months.
First reported Jul 31, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordA new critical vulnerability was disclosed in Fortra's GoAnywhere managed file transfer product, which has been targeted in the past by ransomware and extortion groups
First reported Sep 19, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordTo help security practitioners prioritize vulnerabilities using exploit evidence, we've outlined key considerations and strategies in this blog. Alongside exploit intelligence, it’s crucial to incorporate environmental and asset context using decision-based frameworks such as Stakeholder-Specific Vulnerability Categorization.
First reported Jun 25, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordKey Trends and Findings from 2025’s Known Exploited Vulnerabilities
First reported Jan 21, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordCVE-2023-23752 is an information leak affecting Joomla! 4.0 - 4.7. How can an attacker use this vulnerability to achieve code execution? How many internet-facing systems are at risk?
First reported Mar 23, 2023 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Proof-of-Concept
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordExploit Intel 101 - Common Vulnerabilities and Exposures (CVE)
First reported Dec 04, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck is excited to announce four new leadership team additions!
First reported Oct 12, 2023 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordSevco is a market leader. Through this collaboration, Sevco has integrated VulnCheck data to roll out a significant set of enhancements to its existing vulnerability prioritization and exposure management capabilities.
First reported Aug 01, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordA look into the real dangers of exploitation lurking in the NVD Backlog
First reported May 23, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated SSRF in Monsta FTP 2.14.4, where an IPv4-only blocklist waves through the IPv4-mapped IPv6 form of the cloud metadata endpoint and bypasses both the front gate and the anti-rebinding recheck.
First reported Jul 14, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordInsights on emerging threats, VulnCheck-observed exploitation in the wild, and published CVEs from VulnCheck’s research teams
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordA Look into the Last 6-months of Vulnerability Exploitation… January-June 2025
First reported Jul 30, 2025 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVerizon's 2024 annual DBIR report incident classification patterns mapped to the Mitre Att&CK tactics and techniques.
First reported May 02, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck demonstrates the use of the RocketMQ remoting protocol to retrieve the broker configuration file, and shares attacker payloads used in the wild for exploitation with CVE-2023-33246.
First reported Sep 05, 2023 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck’s Initial Access Intelligence team has been tracking and analyzing half a dozen recent vulnerabilities in Cisco Catalyst SD-WAN Manager, several of which have begun to see in-the-wild exploitation. Industry focus has been on CVE-2026-20127, but several other vulnerabilities also pose significant risk.
First reported Mar 12, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordA Look into the Last Decade of Vulnerability Exploitation… 2014 - 2023
First reported May 05, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.
First reported Sep 22, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordVulnCheck observed in-the-wild exploitation of CVE-2025-11953 targeting exposed React Native Metro servers shortly after public disclosure. Analysis of repeated attacks shows consistent, operational payload delivery rather than opportunistic scanning. This post examines how the vulnerability was exploited and why early exploitation visibility matters for defenders.
First reported Feb 03, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 16:00 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.