Search: “Nuclei”

21 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 38 Exploit / PoC 21 Ransomware 9 Malware 6 Threat actor 5 Research 5 Policy & legal 3 Data breach 2 Tools 2 Industry 2 Phishing & fraud 1 AI safety & security 1

SeverityAll critical 53 high 19 medium 12 low 7 info 4

September 2025 CVE Landscape

Recorded FutureOct 17, 00:00 UTC · Oct 17, 2025Exploit / PoC in the wildCVE-2025-53690 CVE-2021-21311 CVE-2025-20333+6 CVEs

ToolShell Exploit: Critical SharePoint Zero

Recorded FutureAug 21, 00:00 UTC · Aug 21, 2025Exploit / PoC in the wildCVE-2025-53770 CVE-2025-53771 CVE-2025-49706+1 CVEs1

U.S. CISA adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog

Security AffairsDec 4, 07:56 UTC · Dec 4, 2024Exploit / PoC in the wildCVE-2023-45727 CVE-2024-11680 CVE-2024-11667

ProjectSend critical flaw actively exploited in the wild, experts warn

Security AffairsNov 28, 07:28 UTC · Nov 28, 2024Exploit / PoC in the wildCVE-2024-11680

CRYSTALRAY Cyber

Infosecurity MagazineJul 15, 17:15 UTC · Jul 15, 2024Exploit / PoC

CVEMap: Open-source tool to query, browse and search CVEs

Help Net SecurityMar 25, 17:03 UTC · Mar 25, 2024Exploit / PoC in the wild

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...

CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.

Web discovery (articles for new exploits & KEV entries)Sep 8, 06:48 UTC · 8d agoExploit / PoC in the wildCVE-2026-34908

CVE-2026-16232: Checkpoint Quantum Security Management auth bypass ...

Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.

CVE-2026-16232 is an authentication bypass (CWE-287) in the SmartConsole login process of Check Point Quantum Security Management, exploitable via an application token. Disclosed July 22, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog the same day with remediation due July 25. Rapid7, Check Point Research and other vendors confirmed exploitation in the wild, and a public PoC was released. A workaround is available, and federal agencies must comply with BOD 26-04 patching guidance.

Web discovery (articles for new exploits & KEV entries)Sep 5, 08:03 UTC · 11d agoExploit / PoC in the wildCVE-2026-16232