How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later.
We are pleased to announce the release of Vulnerability-Lookup 5.5.0!
This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.
What's New
Role-Based Access Control
The boolean admin flags of previous versions are replaced by a fu
... Show more...
We are pleased to announce the release of Vulnerability-Lookup 5.5.0!
This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.
What's New
Role-Based Access Control
The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.
Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:
The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.
A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.
The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.
Feeder supervision and CSAF resilience
feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.
More VEX enrichment sources and a VEX records UI
New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).
New feeders: Rocky Linux, Ubuntu and TuxCare
New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.
Profile photo and improved public profile
Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.
Changes
Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.
CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.
Fixes
Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.
🙏 A big thank you to all contributors and testers!
Feedback and Support
If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository: github.com/vulnerability-looku… Your feedback is always appreciated!
Motivation
Ingest OSV advisories published by Rocky Linux's Apollo service where no git repo/dump is available by consuming the Apollo paginated OSV API and mapping records into the existing O...
DNS4EU is a privacy-first DNS resolver by the European Union and Whalebone, available for free to all European citizens under the GDPR.
The service is anonymized and offers child protection, ad blocking, DNSSEC, IPv4, IPv6, DoH, DoT, and anycast, ensuring excellent privacy and minimal latency regardless of your location.
Your browsing data stays within the EU and is protected from cyber threats without being monetized!
Experience DNS4EU, the European security ecosystem led by Whalebone. Access our free Public Service for private browsing or upgrade to DNS4GOV for professional-grade government and critical infrastructure protection.
The #ChatGPT-maker said its agent - an AI #system which can operate alone after human instruction – was being tested in a controlled environment but, after finding weaknesses, was able to escape the test limits.They targeted #Hugging Face, one of the world's largest hubs for sharing AI models, gaining access to some internal company systems.
New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers…
DNS4EU is a privacy-first DNS resolver by the European Union and Whalebone, available for free to all European citizens under the GDPR.
The service is anonymized and offers child protection, ad blocking, DNSSEC, IPv4, IPv6, DoH, DoT, and anycast, ensuring excellent privacy and minimal latency regardless of your location.
Your browsing data stays within the EU and is protected from cyber threats without being monetized!
Experience DNS4EU, the European security ecosystem led by Whalebone. Access our free Public Service for private browsing or upgrade to DNS4GOV for professional-grade government and critical infrastructure protection.
"#Meta and #RayBan’s new #AIglasses can be used to secretly record women and young people for sexual reasons,” the #EHE spokesperson continued in their statement to #Hyperallergic. “Simply put, that’s abuse.” The chasm between legality and ethics continues to widen as the use of smart glasses poses additional risks at sites of expected privacy, including hospitals, restrooms,...
We all know the APT numbers for #FancyBear and #CozyBear — #APT28 and #APT29. Both are attributed to Russian #intelligence. #APT1 through 27 are all from #China. Only the #EquationGroup doesn’t have an official APT number? Wake up, you sleeping sheep—we’re being thoroughly taken for a ride here. The Equation Group—run by the #NSA or #CIA — is probably the most dangerous group in the world, and yet it’s the one that doesn’t appear under any number on the #APT list? Who are you trying to fool here when it comes to #cybersecurity?
EasyOptOuts and 404 Media discovered that Apple's Hide My Email, a popular iCloud feature that allows users to receive emails without revealing their personal email address, has a vulnerability which makes the real email address publicly discoverable. The vulnerability has been reported a year ago and is still present.💔
This release adds a reversible data hiding technique based on histogram shifting (Ni et al., IEEE TCSVT 2006): unlike LSB, the original cover image can be recovered pixel-for-pixel after the hidden message is extracted. Includes a new stegano-rdh command line tool.
Added a reversible data hiding technique based on histogram shifting
(stegano.rdh), with a stegano-rdh command line tool. Unlike LSB, the
original cover image can be recovered exactly after the mes...
Vulnerability-Lookup now ingests Red Hat's per-CVE CSAF VEX documents and attaches them straight to the vulnerabilities you're already tracking. Which products are affected? Which are fixed? Which were never affected at all? One glance at the new VEX tab — or the EPSS-style VEX badge right in the vulnerability header — and you know.
No more digging through vendor advisories to answer "does this CVE actually matter to us?" 🔎
Also in this release:
✅ New /api/vex endpoints — VEX data, fully machine-readable 🔐 Per-user enable/disable of CNA publication, with a dedicated admin overview 📬 Admin overview for KEV catalog e-mail subscriptions + richer digest e-mails (entry titles, affected vendors & products) 🛠️ A batch of feeder robustness fixes — no more full re-imports or no
... Show more...
Vulnerability-Lookup now ingests Red Hat's per-CVE CSAF VEX documents and attaches them straight to the vulnerabilities you're already tracking. Which products are affected? Which are fixed? Which were never affected at all? One glance at the new VEX tab — or the EPSS-style VEX badge right in the vulnerability header — and you know.
No more digging through vendor advisories to answer "does this CVE actually matter to us?" 🔎
Also in this release:
✅ New /api/vex endpoints — VEX data, fully machine-readable 🔐 Per-user enable/disable of CNA publication, with a dedicated admin overview 📬 Admin overview for KEV catalog e-mail subscriptions + richer digest e-mails (entry titles, affected vendors & products) 🛠️ A batch of feeder robustness fixes — no more full re-imports or notification storms after a partial download failure
Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure ...
TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository…
Git identifies every object by a hash of its contents, and for a commit that hash covers the tree, the metadata, the message, and the raw bytes of any signature.
Bekijk je favoriete video's, luister naar de muziek die je leuk vindt, upload originele content en deel alles met vrienden, familie en anderen op YouTube.
We are pleased to announce the release of Vulnerability-Lookup 5.3.0!
This release brings email subscriptions to KEV catalogs, letting you receive batched digests whenever new exploited vulnerabilities are added to a catalog you follow. Search gained the long-requested ability to filter and sort by CVSS base score, two new feeder families join the platform — the AVID (AI Vulnerability Database) feeder and a set of new CSAF vendor feeders — and the KEV catalogs page gained a whole suite of coverage visualisations. On the account side, 2FA recovery codes make account recovery safer.
What's New
Email subscriptions to KEV catalogs
You can now subscribe to any KEV catalog and receive batched email digests when new entries are added. Subscriber counts are surfaced on the catalogs page, and the notifications page was modernized onto the shared card design language (
... Show more...
We are pleased to announce the release of Vulnerability-Lookup 5.3.0!
This release brings email subscriptions to KEV catalogs, letting you receive batched digests whenever new exploited vulnerabilities are added to a catalog you follow. Search gained the long-requested ability to filter and sort by CVSS base score, two new feeder families join the platform — the AVID (AI Vulnerability Database) feeder and a set of new CSAF vendor feeders — and the KEV catalogs page gained a whole suite of coverage visualisations. On the account side, 2FA recovery codes make account recovery safer.
What's New
Email subscriptions to KEV catalogs
You can now subscribe to any KEV catalog and receive batched email digests when new entries are added. Subscriber counts are surfaced on the catalogs page, and the notifications page was modernized onto the shared card design language (#457).
Filter and sort by CVSS base score
The search now supports filtering and sorting vulnerabilities by CVSS base score — including CVSS-only searches that need no vendor, product or assigner. The recent vulnerabilities page gained a quick-filter accordion above the table, and the search form now preselects the CVE Program source by default (#454).
New feeders: AVID and more CSAF vendors
A new feeder for the AVID (AI Vulnerability Database) brings AI-specific vulnerability advisories into the platform, with a dedicated advisory view, product search wiring and source registration. Contributed by @thunderstornX in #442.
We also added new CSAF feeders for the vendors whose public feeds actually deliver documents — audited from a much larger candidate list — wired into the web interface and README. Along the way: CERT@VDE trusted-provider metadata URLs were fixed for 12 vendors, the TuxCare feeder now points at its published provider metadata, Palo Alto advisory ids were namespaced so they no longer overwrite canonical CVE records, and the csaf_trend feeder was renamed to csaf_trendmicro (#448).
A coverage timeline chart with a blind-spots gap finder.
Cross-catalog vulnerability search.
Click-to-filter on the UpSet plot columns, plus a mean lead-time and same-day caption.
First-listed/last-updated sort toggles on the coverage table and catalog pages.
Catalog licence badges, and vendor/product shown in the coverage table.
2FA recovery codes
Accounts protected with two-factor authentication can now generate recovery codes for account recovery, and the profile page was restructured into themed cards (#435).
Favorite feed
Users can pick a favorite feed used as the default source on the recent vulnerabilities page, and toggle it directly from that page.
Readable RSS/Atom feeds
RSS/Atom feeds now render as readable pages when opened in a browser: server-side rendering via content negotiation, KEV Atom content emitted as XHTML, and the XSL stylesheet made XSLT 1.0 compatible and served as application/xslt+xml so Chromium-based browsers apply it.
API improvements
Enrichment flags on the bulk vulnerability endpoint.
CORS headers on /api endpoints for browser-based access.
KEV entries resolvable by (origin_uuid, vulnId) for PUT/DELETE.
Other new features
Sightings — Accept more vulnerability identifier patterns: CVE-UNASSIGNED, OpenVAS, SSV, Exploit-DB (EDB) and China National Vulnerability Database (CNVD).
Performance — pg_trgm GIN indexes for sighting source/vulnerability search, with the author lookup split into a UNION leg so the indexes actually apply. Contributed by @DevamShah in #431 (#440).
UI — Filtering, sorting and search on the CNA publications and vulnerability disclosures lists.
Changes
EUVD — Added the EUVD ID data model and Kvrocks key conventions. Contributed by @archakisn in #452.
UI — Continued the UI refresh: the About and About-this-instance pages, a soft azure underglow on the home hero signal line, Choices.js widgets themed with the design tokens, and a themed vendor autocomplete for the navbar search.
Templates — Recent vulnerabilities page polish: a shortcut button to the local instance source, a link to the current source's recent vulnerabilities in the generic CSAF view, and vulnerability identifiers displayed in uppercase in the disclosures list.
Configuration — Added unicode icons to the source names in SOURCES_TO_SHOW.
Documentation — Improved the README, added documentation for running a minimal publication instance (#456), and documented the KEV catalog email subscriptions.
Dependencies — Updated Python dependencies and bumped the pinned GitHub Actions.
Fixes
API — GET /api/vulnerability/recent without a source again returns the most recent entries across all sources (the global index), consistent with /api/vulnerability/last and with the documented behavior. Since 3.0.0 (February 2026) it silently defaulted to the cvelistv5 source only; clients that came to rely on that must now pass source=cvelistv5 explicitly.
Search — A vendor-only search now spans all sources instead of only cvelistv5, and a known-vendor query takes precedence over the linked-vulnerabilities fallback (#432).
Notifications — Widened the notification query window and deduplicated already-sent notifications, so entries indexed with a source-side lastModified older than the wall-clock window are no longer silently skipped; the nvd source is now included and results are deduplicated across sources (#449).
API — KEV endpoint hardening: BCP-07 conformant output, a unique tiebreaker in the list ordering so pagination no longer yields duplicate entries on tie-heavy sorts, unhandled 500 responses marked as no-store, and PUT now only moves first_seen_at/asserted_at backwards (#453).
API — Sighting creation timestamps are set server-side, ILIKE wildcards are escaped in search filters, and the updated date sort uses the correct index key.
Statistics — Current-year charts stop at the current month, bogus delta labels for unfinished months are suppressed (#433), and the selected multi-year window is preserved when switching sources (#436).
Feeds — Aligned the recent feed sort order and timestamps with the /recent page (#443).
KEV — UpSet plot rendering: widened the set-label gutter so long catalog names fit, reserved a numeric lane so totals are not clipped, and clarified the total vs exact-slice reading of the plot.
UI — Stripped global-chrome bleed from the vulnogram editor and corrected its dialog button layout; aligned navbar link tooltips with their labels; showed the public Vulnerability Disclosures link to logged-in users; made vulnerability IDs clickable in the admin disclosures view (#438).
Users — Avoided an N+1 query in the user directory and made the DB pool resilient.
Docker — Read the PostgreSQL URI from website.py to avoid importing psycopg2.
🙏 A big thank you to all contributors and testers!
Feedback and Support
If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository: github.com/vulnerability-looku… Your feedback is always appreciated!
Actual behavior When downloading KEV catalogs from the public Vulnerability-Lookup instance using: GET /api/kev/?vulnerability_lookup_origin=&page=N&per_page=M we are seeing two related issue...
A government customer of NSO Group used the company's Pegasus spyware to hack into the phone of a European politician, who at the time was serving on an EU committee tasked with investigating the spyware industry.
This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform's community.
This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform's community.
New in this report: the Shadowserver KEV catalog, built from honeypot-observed exploitation attempts, makes its first appearance in our monthly reports. A big thank you to The Shadowserver Foundation for making this data available to the community.
June's threat landscape was dominated by actively exploited flaws in enterprise infrastructure: remote-access and management software, network appliances, and identity-adjacent services. Nine of the ten most sighted vulnerabilities of the month are listed in the CISA KEV catalog (eight of them added during June), a strong signal that sighting activity closely tracked in-the-wild exploitation.
The Month at a Glance
7,454 CVEs were published in June 2026 (from the CVE List v5 source alone), up from 6,953 in May -- a 14.5% month-over-month increase and the highest monthly volume of the year so far. On top of that, Vulnerability-Lookup ingested 7,315 GitHub security advisories and 745 PySec advisories over the same period.
Vulnerability-Lookup collected 27,251 sightings during June 2026, including 18,123 "seen" observations, 8,542 exploitation-related sightings, and 71 "confirmed" sightings (mostly newly published Nuclei detection templates). No "patched" or "proof of concept" type sightings were recorded this month. Across the monitored KEV catalogs, 23 entries were added by CISA, 4 by CIRCL, 1 was reported through the ENISA / EU CSIRTs Network feed, and 6 new vulnerabilities appeared in The Shadowserver Foundation's honeypot-observed exploitation feed.
The most sighted vulnerability of the month was CVE-2026-35273, a missing-authentication flaw in Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management), added to the CISA KEV catalog on June 12 with known ransomware campaign use -- the only entry of the month with that flag.
Cisco had a particularly rough month, with three KEV-listed issues: an unauthenticated SSRF in Unified Communications Manager (CVE-2026-20230), a privilege escalation in Catalyst SD-WAN Controller (CVE-2026-20245) and a path traversal in Catalyst SD-WAN Manager (CVE-2026-20262) -- the SD-WAN line remaining a target for the second month in a row after May's Emergency-Directive flaw. Remote-access and remote-management tooling was the other clear cluster: unauthenticated root-level command injection in Ivanti Sentry (CVE-2026-10520, also observed against Shadowserver honeypots), an OIDC authentication bypass in SimpleHelp (CVE-2026-48558), an IKEv1 authentication bypass in Check Point Security Gateway (CVE-2026-50751, confirmed exploited by Check Point), and a pre-authentication RCE in BeyondTrust Remote Support / Privileged Remote Access (CVE-2026-1731) reported by NCSC-FI through the ENISA CNW feed.
Other notable KEV additions include a trio of Ubiquiti UniFi OS flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) added the same day, an unauthenticated arbitrary file creation/truncation in Splunk Enterprise via a PostgreSQL sidecar endpoint (CVE-2026-20253), and -- for the second month running -- an AI-stack entry, with a command injection in BerriAI LiteLLM (CVE-2026-42271) following May's LiteLLM SQL injection. On the client side, both Google Chrome (V8) (CVE-2026-11645) and Android Framework (CVE-2025-48595) were KEV-listed and appeared in the top 10. The high-sighting Windows Netlogon stack-based buffer overflow (CVE-2026-41089) rounded out the picture, and CISA also re-anchored legacy issues -- the Linux kernel cgroups v1 container-escape CVE-2022-0492 and Oracle WebLogic CVE-2024-21182 -- while Shadowserver honeypots still registered attacks against the 2017 HP iLO 4 authentication bypass (CVE-2017-12542).
Across the month's KEV additions, the dominant weakness patterns were missing authentication for critical functions (CWE-306: PeopleSoft, Splunk), authentication bypass and improper authentication (CWE-287/CWE-294: SimpleHelp, Check Point, PAN-OS GlobalProtect), OS command and code injection (CWE-77/78/94: Ivanti Sentry, Lantronix EDS5000, LiteLLM), path traversal (CWE-22: Ubiquiti UniFi OS, Cisco SD-WAN Manager, FortiSandbox), server-side request forgery (CWE-918: Cisco Unified CM), and memory corruption in widely deployed client software (CWE-787/CWE-190: Windows Netlogon, Chrome V8, Android Framework). In overall published volume, cross-site scripting (CWE-79) and SQL injection (CWE-89) once again topped the monthly CWE ranking (see the Top 10 Weaknesses chart below).
New entries have been added to the major Known Exploited Vulnerabilities catalogs during June.
Catalog coverage
30 distinct vulnerabilities entered at least one of the tracked KEV catalogs during June. The matrix below shows, for each of them, which catalogs cover it (as of publication) -- built with the new KEV catalog coverage feature of Vulnerability-Lookup. The KEVIntel catalog, the highest-volume of the tracked feeds with 335 new entries in June alone, covers 28 of the 30; conversely, two entries (HP iLO 4 and the MeiG router) are visible only through Shadowserver's honeypots, and the Ivanti Sentry command injection is the only vulnerability of the month present in four catalogs at once.
The CIRCL KEV catalog added 4 entries during June. The Check Point IKEv1 authentication bypass was confirmed on the basis of Check Point's own report of active exploitation in the wild; the Cisco SD-WAN and Ivanti Sentry entries are marked as suspected exploitation.
A single new entry was reported through the ENISA / EU CSIRTs Network (CNW) KEV feed during June: a critical pre-authentication remote code execution in BeyondTrust Remote Support and Privileged Remote Access, reported by NCSC-FI.
The Shadowserver KEV catalog is fed by honeypot-observed exploitation attempts. 6 vulnerabilities were observed for the first time during June, two of which are also in the CISA KEV catalog. Notably, the 2017 HP iLO 4 authentication bypass was still drawing attack traffic at the very end of the month.
Community contributions in June ranged from data-quality improvements to supply-chain research:
Impact of MISP.disableUserSelfManagement on exploitability -- a practical exploitability note on GCVE-1-2026-20092 explaining that when MISP.disableUserSelfManagement is enabled on a MISP instance, non-admin users cannot reach the vulnerable endpoint -- a useful triage criterion for instance operators.
If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us! github.com/vulnerability-looku…
Funding
The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole. Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.
The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL's contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.
Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities.
Although the family's current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Research has found that the family is undergoing a comprehensive technological transition from C to Rust, and its anti-defense and traffic encryption techniques are also iterating rapidly. Based on the shift of its technology stack from C to Rust and the characteristic of early core payloads encrypting three duckdns C2 domains, we have named it RustDuck.
In terms of sample propagation
... Show more...
Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities.
Although the family's current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Research has found that the family is undergoing a comprehensive technological transition from C to Rust, and its anti-defense and traffic encryption techniques are also iterating rapidly. Based on the shift of its technology stack from C to Rust and the characteristic of early core payloads encrypting three duckdns C2 domains, we have named it RustDuck.
In terms of sample propagation, the spread chain of this family mainly covers IoT devices, web applications, and enterprise infrastructure. The attack methods primarily involve weak password brute-forcing (Telnet/SSH) and the exploitation of various RCE vulnerabilities, including device vulnerabilities in Android ADB, TVT API, Ruijie, TP-Link, ZTE, and others, as well as web/component vulnerabilities such as ThinkPHP, Jenkins, YARN. It also combines several historical CVEs (CVE-2025-29635, CVE-2017-17215, CVE-2018-8007, CVE-2024-1781) to expand the attack surface. Overall, it presents a combined propagation characteristic of "weak passwords + IoT vulnerabilities + Web RCE", capable of covering routers, cameras, Android terminals, and server environments, enabling large-scale automated intrusion and payload delivery. Currently, over 20 IPs have been observed participating in spreading the RustDuck botnet, with the most active implant source IP being: 176.65.139[.]204
Overview
Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture.
We are excited to share the result of a fruitful collaboration with The Shadowserver Foundation: a new Known Exploited Vulnerabilities (KEV) Catalog (BCP-07 compliant) built directly from their global honeypot telemetry.
Most KEV catalogs tell you what is being exploited. This one is grounded in observed exploitation attempts captured across Shadowserver's worldwide honeypot sensor network. When a vulnerability is exploited against one of their honeypots, it becomes an attributable, structured GCVE-EU BCP-07 KEV assertion, complete with evidence typing (honeypot), exploitation signals (in_the_wild_attempts), and timestamps indicating when exploitation was first and last observed.
A huge thank-you to the Shadowserver team, and especially to Piotr Kijewski, for their support and collaboration.
Ignoring EFF’s warnings about the dangers and impossibility of implementing a new mandate for 3D print surveillance software, the California State Assembly has signed off on legislation to do just that.
