Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
A Look into the Last Decade of Vulnerability Exploitation… 2014 - 2023
First reported May 05, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.
First reported Sep 22, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck observed in-the-wild exploitation of CVE-2025-11953 targeting exposed React Native Metro servers shortly after public disclosure. Analysis of repeated attacks shows consistent, operational payload delivery rather than opportunistic scanning. This post examines how the vulnerability was exploited and why early exploitation visibility matters for defenders.
First reported Feb 03, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordCisco Catalyst SD-WAN vManager's login module and application server disagree about whether a request path has been URL-decoded yet. That single percent-encoded character gives us CVE-2026-76504. One unauthenticated POST with an arbitrary password triggers a critical authentication bypass that gives an attacker admin-level access to the entire SD-WAN fabric.
First reported Oct 01, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck now provides an automated approach to providing broader visibility into differences between VulnCheck KEV and CISA KEV through a Jupyter Notebook publicly available on GitHub.
First reported Dec 05, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordBring real-world exploit and vulnerability intelligence directly into Splunk, making it easier for security teams to enrich CVE data, prioritize remediation and respond faster to emerging threats.
First reported Apr 20, 2026 14:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordThe latest feature to hit go-exploit is ShellTunnel. ShellTunnel captures reverse shell traffic and routes it through an intermediary attacker-controlled server before reaching the main command-and-control (C2) server.
First reported Nov 01, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordOEM Use Case Series: Reducing Attack Surface Risk - Know Who Your Adversaries Are and How Naming Conventions Matter in Vulnerability Management
First reported Oct 23, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordTaking a data-driven approach to visualizing the profile of threat actors can provide meaningful information without the time-consuming process of sifting through lengthy reports of information.
First reported Feb 15, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Availability
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through a borrowed admin session, into remote code execution.
First reported Sep 30, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck's Initial Access Intelligence team details four authenticated remote code execution vulnerabilities in FileRun, where a contact-sheet handler and a settings test endpoint run attacker input through a shell, and a delegated administrator turns a control-panel field into stacked SQL that a permission-blob deserialization weaponizes into a webshell.
First reported Sep 10, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordUsing VulnCheck KEV, we explore the anatomy of an exploited CVE. We map publicly available exploitation evidence to Atlassian Confluence CVE-2023-22527 to create a visual timeline of exploitation.
First reported Feb 27, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordA look into Anthropic Glasswing's latest update to their vulnerability disclosure ledger.
First reported Sep 08, 2026 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordThis integration brings VulnCheck’s exploit-centric vulnerability intelligence directly into ThreatQ, enabling joint customers to supercharge threat operations, vulnerability prioritization, and incident response with real-world exploit data.
First reported Jul 02, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordWhat’s really being targeted at the network edge? VulnCheck’s 2026 research shows that a significant portion of exploited vulnerabilities affect end-of-life devices, with consumer networking equipment and botnets driving much of the activity. This report breaks down the trends shaping real-world exploitation.
First reported Mar 23, 2026 14:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordA month after disclosure, hundreds of ScriptCase servers remain exposed and actively targeted. This post walks through finding vulnerable instances, exploiting them with just a few curl commands, and the key detection points defenders can use to stop attacks.
First reported Aug 14, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordAdding support for external C2 channels and payloads in the go-exploit framework to enable flexible exploitation interaction and platform integration.
First reported Sep 11, 2024 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordVulnCheck Canary Intelligence uncovered a long-running attacker-owned OAST service operating from Google Cloud. The actor blended stock Nuclei templates with custom payloads while focusing their activity on canaries deployed in a single region. This unusual combination reveals a structured, sustained scanning operation rather than ordinary opportunistic spraying.
First reported Nov 27, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordIn search of an interesting new detail about CVE-2022-1388, VulnCheck researchers pore over open source intelligence. The researchers detail exploit variants, find signature bypasses, and publish a novel exploit variant.
First reported Apr 13, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordExploit Intel 101 - Attacker Infrastructure
First reported Apr 18, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordCreating a language-native .NET source for deserialization gadgets
First reported Nov 12, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordA common topic that’s been brought to my attention on several occasions is the perceived increase in vulnerabilities deemed “Critical” by their CVSS severity. According to FIRST, CVSS severity ratings are intended to help organizations assess and prioritize vulnerability management efforts. With this in mind, I set out to explore CVSS severity trends over time, which ultimately led me to examine the impact and adoption of CVSS v4.
First reported Dec 15, 2025 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordExploit-DB and 0day.today are two of the largest public exploit databases. In this blog, we compare the databases to determine which one is the most relevant today.
First reported Mar 31, 2023 00:00 UTCCatalog metadata updated Oct 13, 2026 15:57 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.