Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
New CVE-2025-2611 attacks led us to a selective exploitation tool named frost that only fires when targets match precise fingerprints. VulnCheck's Canary Intelligence, EVI, and IP Intel exposed the CVEs involved, the operator's infrastructure, and the internet-exposed systems they can reach.
First reported Dec 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA common topic that’s been brought to my attention on several occasions is the perceived increase in vulnerabilities deemed “Critical” by their CVSS severity. According to FIRST, CVSS severity ratings are intended to help organizations assess and prioritize vulnerability management efforts. With this in mind, I set out to explore CVSS severity trends over time, which ultimately led me to examine t
First reported Dec 15, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck tracked thousands of attacker systems over a 90-day window to see how long malicious infrastructure really lasts. The results show that exposure doesn’t mean disruption, as many phishing kits, proxies, and C2 tools stay online for weeks or even months.
First reported Jul 31, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploring an unauthenticated remote code execution in the SmarterTools SmarterMail server via the ConnectToHub mounting functionality.
First reported Jan 26, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA new critical vulnerability was disclosed in Fortra's GoAnywhere managed file transfer product, which has been targeted in the past by ransomware and extortion groups
First reported Sep 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordInstead of bouncing between tabs, you now get instant, current context the moment a CVE appears on your screen.
First reported Sep 08, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordRecent disclosures around two recent Linux LPEs Copy Fail and Dirty Frag discovered with the assistance of AI have exposed a broader class of Linux kernel local privilege escalation vulnerabilities involving page-cache overwrite primitives. This analysis separates the technical reality from the noisy wave of AI-generated disclosures and recycled proofs of concept
First reported Jun 11, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordForrester’s recent blog by Eric Nost, Mitregeddon Averted, But Fragility in CVE Processes Remain, shines a much-needed spotlight on the systemic challenges facing the CVE and NVD ecosystem from the industry analyst perspective.
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordAttackers are abusing an unauthenticated command injection bug in ICTBroadcast (CVE-2025-2611) to execute remote commands and drop reverse shells. VulnCheck caught the exploitation, linked it to related research, and had detections available for customers well before the activity began.
First reported Oct 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Proof-of-Concept
First reported May 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordIn-depth analysis of 2025 CVEs and exploit trends from VulnCheck’s research team. The 2026 Exploit Intelligence Report includes an evaluation of the public exploit ecosystem, ransomware and state-sponsored threat actor deep dives, and a data-driven list of 2025’s routinely targeted vulnerabilities.
First reported Feb 25, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck identifies an unauthenticated remote code execution in the BigAnt chat server
First reported Feb 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCVE-2025-53652 was disclosed as a medium-severity vulnerability in the Jenkins Git Parameter plugin but it enables command injection and remote code execution when this popular plugin is installed. We break down the vulnerability and share detection guidance for defenders.
First reported Aug 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck provides automated SSVC decisions for federal and enterprise agencies to help address CISA BOD 26-04.
First reported Jun 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck Canary Intelligence uncovered a long-running attacker-owned OAST service operating from Google Cloud. The actor blended stock Nuclei templates with custom payloads while focusing their activity on canaries deployed in a single region. This unusual combination reveals a structured, sustained scanning operation rather than ordinary opportunistic spraying.
First reported Nov 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordCisco Catalyst SD-WAN vManager's login module and application server disagree about whether a request path has been URL-decoded yet. That single percent-encoded character gives us CVE-2026-76504. One unauthenticated POST with an arbitrary password triggers a critical authentication bypass that gives an attacker admin-level access to the entire SD-WAN fabric.
First reported Oct 01, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis quarter was a defining one for VulnCheck — not just in numbers, but in what those numbers represent and how critical VulnCheck is in both enriching cyber products in the market and protecting our global economy and national security.
First reported Oct 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding APTs
First reported Apr 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck reviewed the full wave of React2Shell exploits published on GitHub, discarding about half as broken or misleading and surfacing several genuinely interesting techniques from the rest. We curated the usable set, highlighted the notable variants, and made the entire approved dataset freely available in VulnCheck's Exploit Database (XDB).
First reported Dec 12, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordThis research aims to share experiences and observations to help others better understand how ENISA EUVD compares with existing vulnerability sources and whether it can serve as a reliable alternative for these established services.
First reported May 20, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordFortinet disclosed two critical vulnerabilities on December 9 that arise from improper cryptographic signature verification and enable remote attackers to bypass SSO login on vulnerable devices. The vulnerabilities are being exploited in the wild.
First reported Dec 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordExploit Intel 101 - Understanding Exploit Maturity
First reported May 21, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordVulnCheck and partner GreyNoise discovered Zyxel-related vulnerabilities being targeted in the wild. In this blog, VulnCheck describes the vulnerabilities CVE-2024-40891 and CVE-2025-0890.
First reported Feb 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordWhat’s really being targeted at the network edge? VulnCheck’s 2026 research shows that a significant portion of exploited vulnerabilities affect end-of-life devices, with consumer networking equipment and botnets driving much of the activity. This report breaks down the trends shaping real-world exploitation.
First reported Mar 23, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.