{"uuid": "647f3c04-0b5e-49a5-ba95-38cbd974594a", "vulnerability": {"vulnId": "CVE-2022-0679", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "647f3c04-0b5e-49a5-ba95-38cbd974594a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:04:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:04:58+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Narnoo Distributor plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0679", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0679"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Narnoo Distributor plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1366e476-d31d-4c7c-b8b7-ddeef8adf015", "vulnerability": {"vulnId": "CVE-2016-6277", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1366e476-d31d-4c7c-b8b7-ddeef8adf015", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-13T16:38:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:38:51+00:00"}, "scope": {"notes": "Affected: Netgear / NETGEAR R/D Series Routers | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 106", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-6277", "url": "https://www.cve.org/CVERecord?id=CVE-2016-6277"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "106", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 92, "vendor": "Netgear", "30d_avg": 87, "90d_avg": 89, "product": "NETGEAR R/D Series Routers", "cisa_kev": "yes", "connections": 106, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "61b70a98-ec1b-429b-ad76-1054152a4a75", "vulnerability": {"vulnId": "CVE-2020-12124", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "61b70a98-ec1b-429b-ad76-1054152a4a75", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-30T01:01:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-30T01:01:26+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN530H4 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-12124", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12124"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "WAVLINK", "30d_avg": 0, "90d_avg": 1, "product": "WAVLINK WN530H4", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0706f6b0-6972-49ed-828c-03e7281d085c", "vulnerability": {"vulnId": "CVE-2023-26802", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0706f6b0-6972-49ed-828c-03e7281d085c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-16T19:55:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-16T19:55:44+00:00"}, "scope": {"notes": "Affected: DCN (Digital China Networks) / DCBI-Netlog-LAB | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26802", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26802"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "DCN (Digital China Networks)", "30d_avg": 1, "90d_avg": 2, "product": "DCBI-Netlog-LAB", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1dc7ab92-f6e9-4d1e-bb40-bc77f3c57ede", "vulnerability": {"vulnId": "CVE-2018-11759", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1dc7ab92-f6e9-4d1e-bb40-bc77f3c57ede", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-12-19T00:01:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-19T00:01:07+00:00"}, "scope": {"notes": "Affected: Apache / libapache-mod-jk | Class: web-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 27", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11759", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11759"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 3, "vendor": "Apache", "30d_avg": 7, "90d_avg": 5, "product": "libapache-mod-jk", "cisa_kev": "no", "connections": 27, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "28544f7c-b92a-4f0b-858f-07df4b8afbd5", "vulnerability": {"vulnId": "CVE-2016-3088", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "28544f7c-b92a-4f0b-858f-07df4b8afbd5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:17:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:17:37+00:00"}, "scope": {"notes": "Affected: Apache / ActiveMQ | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 34", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-3088", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3088"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 5, "90d_avg": 4, "product": "ActiveMQ", "cisa_kev": "yes", "connections": 34, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3857165e-c4a5-4543-8d62-74c6f8035159", "vulnerability": {"vulnId": "CVE-2023-31059", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3857165e-c4a5-4543-8d62-74c6f8035159", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-13T05:23:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-13T05:23:42+00:00"}, "scope": {"notes": "Affected: Hot-World GmbH / Repetier Server | Class: printer | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-31059", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 0, "vendor": "Hot-World GmbH", "30d_avg": 0, "90d_avg": 1, "product": "Repetier Server", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3c996d32-53d2-4ad3-ba28-875505dafbce", "vulnerability": {"vulnId": "CVE-2025-34038", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3c996d32-53d2-4ad3-ba28-875505dafbce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:50:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:50:48+00:00"}, "scope": {"notes": "Affected: Shanghai Fanwei Network Technology / Panwei e-cology | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34038", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34038"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Shanghai Fanwei Network Technology", "30d_avg": 1, "90d_avg": 1, "product": "Panwei e-cology", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "794bf2b2-e052-4cf1-82cf-a029cb0a0d90", "vulnerability": {"vulnId": "CVE-2020-11991", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "794bf2b2-e052-4cf1-82cf-a029cb0a0d90", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:18+00:00"}, "scope": {"notes": "Affected: Apache / Cocoon | Class: web-app-framework | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11991", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11991"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "Cocoon", "cisa_kev": "no", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "b0b42a41-d9b3-4b2f-9c81-0ff65a45d246", "vulnerability": {"vulnId": "CVE-2019-12987", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b0b42a41-d9b3-4b2f-9c81-0ff65a45d246", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12987", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12987"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 1, "90d_avg": 1, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e69e785f-ff26-42a6-93fb-d46e7709bef9", "vulnerability": {"vulnId": "CVE-2024-38514", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e69e785f-ff26-42a6-93fb-d46e7709bef9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 74}, "timestamps": {"asserted_at": "2025-02-25T23:16:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-25T23:16:16+00:00"}, "scope": {"notes": "Affected: NextChat (ChatGPT-Next-Web) / NextChat (ChatGPT-Next-Web) | Class: ai-system | Severity: High (CVSS 7.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-38514", "url": "https://www.cve.org/CVERecord?id=CVE-2024-38514"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "NextChat (ChatGPT-Next-Web)", "30d_avg": 0, "90d_avg": 1, "product": "NextChat (ChatGPT-Next-Web)", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.4, "vulnerability_severity": "High"}}]}
{"uuid": "d91ddd61-74c9-4b65-96fe-09ce73a7282e", "vulnerability": {"vulnId": "CVE-2021-44427", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d91ddd61-74c9-4b65-96fe-09ce73a7282e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-18T00:54:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-18T00:54:56+00:00"}, "scope": {"notes": "Affected: RosarioSIS / RosarioSIS | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-44427", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44427"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "RosarioSIS", "30d_avg": 0, "90d_avg": 2, "product": "RosarioSIS", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "562a82b3-51f1-4769-8ae8-3584a3af01d6", "vulnerability": {"vulnId": "CVE-2025-61666", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "562a82b3-51f1-4769-8ae8-3584a3af01d6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2025-11-17T12:03:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-17T12:03:57+00:00"}, "scope": {"notes": "Affected: Traccar / Traccar | Class: device-management-platform | Severity: High (CVSS 8.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-61666", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61666"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Traccar", "30d_avg": 0, "90d_avg": 1, "product": "Traccar", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}]}
{"uuid": "71b36c76-6fff-41fd-aac3-47bc2b629e53", "vulnerability": {"vulnId": "CVE-2019-2768", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "71b36c76-6fff-41fd-aac3-47bc2b629e53", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-22T08:12:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-22T08:12:20+00:00"}, "scope": {"notes": "Affected: Oracle / BI Publisher (Oracle Fusion Middleware) | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-2768", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2768"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "BI Publisher (Oracle Fusion Middleware)", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5b7ae4df-2c7f-4960-a4ec-f73f05293c17", "vulnerability": {"vulnId": "CVE-2023-34960", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5b7ae4df-2c7f-4960-a4ec-f73f05293c17", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:51+00:00"}, "scope": {"notes": "Affected: Chamilo / Chamilo | Class: cms | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34960", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34960"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Chamilo", "30d_avg": 1, "90d_avg": 2, "product": "Chamilo", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "b3ed8f46-7e71-4e1e-a8be-b4a021db3d9d", "vulnerability": {"vulnId": "CVE-2024-50967", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b3ed8f46-7e71-4e1e-a8be-b4a021db3d9d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-27T10:55:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-27T10:55:52+00:00"}, "scope": {"notes": "Affected: becon / DATAGERRY | Class: database | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-50967", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50967"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "becon", "30d_avg": 0, "90d_avg": 1, "product": "DATAGERRY", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "3d085b76-fffc-4f6e-8304-988940047495", "vulnerability": {"vulnId": "CVE-2025-2294", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3d085b76-fffc-4f6e-8304-988940047495", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-06T20:39:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-06T20:39:53+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Kubio AI Page Builder plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-2294", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2294"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 2, "90d_avg": 1, "product": "Wordpress Kubio AI Page Builder plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8af805ac-82d9-41c7-bb53-ab92948a3ce2", "vulnerability": {"vulnId": "CVE-2021-20123", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8af805ac-82d9-41c7-bb53-ab92948a3ce2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-04T13:41:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-04T13:41:46+00:00"}, "scope": {"notes": "Affected: Draytek / VigorConnect | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20123", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20123"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Draytek", "30d_avg": 5, "90d_avg": 3, "product": "VigorConnect", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "d90675b8-4591-4173-8dc8-30f52bc2ce98", "vulnerability": {"vulnId": "CVE-2023-43654", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d90675b8-4591-4173-8dc8-30f52bc2ce98", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-26T03:32:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-26T03:32:02+00:00"}, "scope": {"notes": "Affected: PyTorch / PyTorch TorchServe | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-43654", "url": "https://www.cve.org/CVERecord?id=CVE-2023-43654"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "PyTorch", "30d_avg": 0, "90d_avg": 2, "product": "PyTorch TorchServe", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2da958ed-c1f6-458f-9d5c-9ae8c876bdf3", "vulnerability": {"vulnId": "CVE-2018-6605", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2da958ed-c1f6-458f-9d5c-9ae8c876bdf3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:25:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:25:45+00:00"}, "scope": {"notes": "Affected:  Open Source Matters, Inc/Joomla community / Joomla Zh BaiduMap component | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-6605", "url": "https://www.cve.org/CVERecord?id=CVE-2018-6605"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": " Open Source Matters, Inc/Joomla community", "30d_avg": 1, "90d_avg": 2, "product": "Joomla Zh BaiduMap component", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eb91473c-18e1-429c-8c6c-90844e03b73f", "vulnerability": {"vulnId": "CVE-2024-45388", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eb91473c-18e1-429c-8c6c-90844e03b73f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-12-05T03:40:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T03:40:39+00:00"}, "scope": {"notes": "Affected: SpectoLabs / HoverFly | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-45388", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45388"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "SpectoLabs", "30d_avg": 1, "90d_avg": 2, "product": "HoverFly", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "40c255fb-351e-4920-818b-bd79ba0300a2", "vulnerability": {"vulnId": "CVE-2021-39316", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "40c255fb-351e-4920-818b-bd79ba0300a2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:13+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Zoomsounds plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39316", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39316"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Zoomsounds plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "80ab4c08-22c7-4f36-919c-8d80c273ca81", "vulnerability": {"vulnId": "CVE-2020-35235", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "80ab4c08-22c7-4f36-919c-8d80c273ca81", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Elfinder plugin | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35235", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35235"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Elfinder plugin", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "db9316b5-1746-4f75-9eba-1f22610bff16", "vulnerability": {"vulnId": "CVE-2024-32640", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "db9316b5-1746-4f75-9eba-1f22610bff16", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-05-16T10:40:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-05-16T10:40:01+00:00"}, "scope": {"notes": "Affected: MASA CMS / MASA CMS | Class: cms | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32640", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32640"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "MASA CMS", "30d_avg": 1, "90d_avg": 2, "product": "MASA CMS", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "384235c3-d3c5-4d21-b5c4-cb9f4c2ae017", "vulnerability": {"vulnId": "CVE-2021-29441", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "384235c3-d3c5-4d21-b5c4-cb9f4c2ae017", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T21:07:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T21:07:05+00:00"}, "scope": {"notes": "Affected: Alibaba / Nacos | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 27", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-29441", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29441"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Alibaba", "30d_avg": 1, "90d_avg": 9, "product": "Nacos", "cisa_kev": "no", "connections": 27, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0375ab25-7c6a-47eb-beb4-63f93cfe42ed", "vulnerability": {"vulnId": "CVE-2021-21805", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0375ab25-7c6a-47eb-beb4-63f93cfe42ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: Advantech / R-SeeNet | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21805", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21805"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Advantech", "30d_avg": 0, "90d_avg": 2, "product": "R-SeeNet", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4c0517e1-b7bc-4d53-9884-bed66753d96e", "vulnerability": {"vulnId": "CVE-2022-24260", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4c0517e1-b7bc-4d53-9884-bed66753d96e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:27+00:00"}, "scope": {"notes": "Affected: VoIPmonitor / VoIPmonitor | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24260", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24260"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "VoIPmonitor", "30d_avg": 1, "90d_avg": 2, "product": "VoIPmonitor", "cisa_kev": "no", "connections": 13, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "40103039-17c5-48c8-8602-3df376c0eb22", "vulnerability": {"vulnId": "CVE-2025-55346", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "40103039-17c5-48c8-8602-3df376c0eb22", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-19T22:59:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-19T22:59:15+00:00"}, "scope": {"notes": "Affected: FlowiseAI / Flowise | Class: ai-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-55346", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55346"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "FlowiseAI", "30d_avg": 0, "90d_avg": 2, "product": "Flowise", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0eab300f-c4b7-4e97-9e27-058b4b58f30f", "vulnerability": {"vulnId": "CVE-2022-0785", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0eab300f-c4b7-4e97-9e27-058b4b58f30f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:43:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:43:02+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Daily Prayer Time plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0785"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Daily Prayer Time plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eaa3d2fb-db92-4b0d-9fc4-a6c4a32b8b42", "vulnerability": {"vulnId": "CVE-2024-36858", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eaa3d2fb-db92-4b0d-9fc4-a6c4a32b8b42", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-15T08:02:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-15T08:02:30+00:00"}, "scope": {"notes": "Affected: Homebrew Computer Company / Jan | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-36858", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36858"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Homebrew Computer Company", "30d_avg": 0, "90d_avg": 0, "product": "Jan", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b5d4c553-f674-48ba-9620-e2a86a2b4496", "vulnerability": {"vulnId": "CVE-2021-40539", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b5d4c553-f674-48ba-9620-e2a86a2b4496", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine ADSelfService Plus | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-40539", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40539"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 5, "90d_avg": 4, "product": "ManageEngine ADSelfService Plus", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d00febbd-741a-4af5-a5f6-82b4ca156c88", "vulnerability": {"vulnId": "CNVD-2023-27598", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d00febbd-741a-4af5-a5f6-82b4ca156c88", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T21:26:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T21:26:05+00:00"}, "scope": {"notes": "Affected: Apache / Solr | Class: database | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 26", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Solr", "cisa_kev": "no", "connections": 26, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "77fbe166-4ea6-4bae-9acb-c2033e4fa0ca", "vulnerability": {"vulnId": "CVE-2025-34049", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "77fbe166-4ea6-4bae-9acb-c2033e4fa0ca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:37:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:37:59+00:00"}, "scope": {"notes": "Affected: OptiLink / ONT1GEW | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34049", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34049"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "OptiLink", "30d_avg": 0, "90d_avg": 0, "product": "ONT1GEW", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "29b6053e-8cc7-4ace-8a04-da56fd5deb27", "vulnerability": {"vulnId": "EDB-48260", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "29b6053e-8cc7-4ace-8a04-da56fd5deb27", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-19T01:31:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T01:31:02+00:00"}, "scope": {"notes": "Affected: Jinfornet / Jreport | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-48260", "url": "https://www.exploit-db.com/exploits/48260"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Jinfornet", "30d_avg": 0, "90d_avg": 0, "product": "Jreport", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "8ff06bcc-bb2a-4b3c-8211-9c27155ffd78", "vulnerability": {"vulnId": "CVE-2021-38154", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8ff06bcc-bb2a-4b3c-8211-9c27155ffd78", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-03-11T05:09:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-11T05:09:48+00:00"}, "scope": {"notes": "Affected: Canon / Canon devices (various) | Class: printer | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-38154", "url": "https://www.cve.org/CVERecord?id=CVE-2021-38154"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 0, "vendor": "Canon", "30d_avg": 5, "90d_avg": 4, "product": "Canon devices (various)", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "ce3bfd59-5fcb-4339-a375-dc93f3ba1223", "vulnerability": {"vulnId": "CVE-2024-6587", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ce3bfd59-5fcb-4339-a375-dc93f3ba1223", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-08-22T07:14:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-22T07:14:14+00:00"}, "scope": {"notes": "Affected: LiteLLM / LiteLLM | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6587", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6587"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "LiteLLM", "30d_avg": 0, "90d_avg": 2, "product": "LiteLLM", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "7a06e53d-b4f7-4594-bdd2-e07421c01c9e", "vulnerability": {"vulnId": "CVE-2021-24227", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7a06e53d-b4f7-4594-bdd2-e07421c01c9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:50+00:00"}, "scope": {"notes": "Affected: Wordpress / Patreon Wordpress plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24227", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24227"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Patreon Wordpress plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "6ee1af1a-6249-443c-b0d1-832e57f5cef5", "vulnerability": {"vulnId": "CVE-2023-52028", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6ee1af1a-6249-443c-b0d1-832e57f5cef5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-07T21:47:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-07T21:47:11+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A3700R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-52028", "url": "https://www.cve.org/CVERecord?id=CVE-2023-52028"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Totolink", "30d_avg": 1, "90d_avg": 3, "product": "Totolink A3700R", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5d52a7bd-e68e-446f-bcb3-785d407c9351", "vulnerability": {"vulnId": "CVE-2024-8425", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5d52a7bd-e68e-446f-bcb3-785d407c9351", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-14T03:28:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-14T03:28:53+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WooCommerce Ultimate Gift Card plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8425", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8425"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 3, "product": "Wordpress WooCommerce Ultimate Gift Card plugin", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "21135376-d482-4c9a-82e2-d68154d7501a", "vulnerability": {"vulnId": "CVE-2021-25864", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "21135376-d482-4c9a-82e2-d68154d7501a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:53+00:00"}, "scope": {"notes": "Affected: node-red-contrib-huemagic / node-red-contrib-huemagic (for Philips HUE | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-25864", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25864"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "node-red-contrib-huemagic", "30d_avg": 0, "90d_avg": 1, "product": "node-red-contrib-huemagic (for Philips HUE", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "f2b62cfe-7397-42bd-953a-ea4405f4429b", "vulnerability": {"vulnId": "CVE-2022-29153", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2b62cfe-7397-42bd-953a-ea4405f4429b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:29+00:00"}, "scope": {"notes": "Affected: HashiCorp / Consul and Consul Enterprise | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29153", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29153"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "HashiCorp", "30d_avg": 4, "90d_avg": 4, "product": "Consul and Consul Enterprise", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "0e9ec25e-6c9f-486a-bba1-2731a61edca1", "vulnerability": {"vulnId": "CVE-2023-6114", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e9ec25e-6c9f-486a-bba1-2731a61edca1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-04-11T20:16:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-11T20:16:56+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Duplicator/Duplicator Pro plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6114", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6114"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress Duplicator/Duplicator Pro plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e20260a1-1b64-4c45-a4eb-4d40ac95b705", "vulnerability": {"vulnId": "CVE-2024-38653", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e20260a1-1b64-4c45-a4eb-4d40ac95b705", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-12-12T14:20:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-12T14:20:09+00:00"}, "scope": {"notes": "Affected: Ivanti / Avalanche | Class: mobile-device-management | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-38653", "url": "https://www.cve.org/CVERecord?id=CVE-2024-38653"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 2, "product": "Avalanche", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9d242fe9-e356-4900-b69b-9f0dc0e91bd3", "vulnerability": {"vulnId": "CVE-2023-31446", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9d242fe9-e356-4900-b69b-9f0dc0e91bd3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-21T16:46:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-21T16:46:52+00:00"}, "scope": {"notes": "Affected: Cassia / Cassia Gateway | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-31446", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31446"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Cassia", "30d_avg": 1, "90d_avg": 2, "product": "Cassia Gateway", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b7d9b195-0c10-4d1e-bbed-d42efa998275", "vulnerability": {"vulnId": "CVE-2022-4447", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b7d9b195-0c10-4d1e-bbed-d42efa998275", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:40+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Fontsy plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4447", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4447"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Fontsy plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "14846244-3a86-4696-aa59-7cce5010ffec", "vulnerability": {"vulnId": "CVE-2020-26948", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "14846244-3a86-4696-aa59-7cce5010ffec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-18T13:25:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-18T13:25:03+00:00"}, "scope": {"notes": "Affected: Emby / Emby Server | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-26948", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26948"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Emby", "30d_avg": 0, "90d_avg": 1, "product": "Emby Server", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bcdab27f-cd18-4cc1-b84d-e1cfd4071a76", "vulnerability": {"vulnId": "CVE-2020-8193", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bcdab27f-cd18-4cc1-b84d-e1cfd4071a76", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-13T18:37:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T18:37:22+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | Class: app-delivery-controller | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8193", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8193"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 3, "vendor": "Citrix", "30d_avg": 2, "90d_avg": 30, "product": "Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "49e32cd3-bde7-440d-bc3c-e3cd522a9e64", "vulnerability": {"vulnId": "CVE-2023-35885", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "49e32cd3-bde7-440d-bc3c-e3cd522a9e64", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-14T13:01:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-14T13:01:29+00:00"}, "scope": {"notes": "Affected: CloudPanel / CloudPanel | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35885", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35885"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "CloudPanel", "30d_avg": 4, "90d_avg": 4, "product": "CloudPanel", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "dd2e7d9e-f464-4119-b76d-16a9bb2e1acf", "vulnerability": {"vulnId": "CVE-2023-33246", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dd2e7d9e-f464-4119-b76d-16a9bb2e1acf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-15T00:37:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T00:37:13+00:00"}, "scope": {"notes": "Affected: Apache | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-33246", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33246"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "rocketmq-scan", "class": null, "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "894d44bf-ad64-420b-8810-6c465012e4ca", "vulnerability": {"vulnId": "CVE-2025-31324", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "894d44bf-ad64-420b-8810-6c465012e4ca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-04-27T22:21:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-04-27T22:21:09+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver | Class: app-server | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-31324", "url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "SAP", "30d_avg": 1, "90d_avg": 1, "product": "NetWeaver", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "91340599-32fd-42fa-b378-c97099fc43d1", "vulnerability": {"vulnId": "CVE-2023-27640", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "91340599-32fd-42fa-b378-c97099fc43d1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-04-27T04:54:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-27T04:54:26+00:00"}, "scope": {"notes": "Affected: PrestaShop / PrestaShop tshirtecommerce | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27640", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27640"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "PrestaShop", "30d_avg": 0, "90d_avg": 1, "product": "PrestaShop tshirtecommerce", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "06ce06be-190b-406e-a406-a5cdf0e7236b", "vulnerability": {"vulnId": "CVE-2022-23178", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "06ce06be-190b-406e-a406-a5cdf0e7236b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-26T05:54:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-26T05:54:41+00:00"}, "scope": {"notes": "Affected: Crestron / Crestron HD-MD4X2-4K-E | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-23178", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23178"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Crestron", "30d_avg": 0, "90d_avg": 2, "product": "Crestron HD-MD4X2-4K-E", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2e5255ff-64f6-4787-9bdb-b6767132e530", "vulnerability": {"vulnId": "CVE-2023-7309", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e5255ff-64f6-4787-9bdb-b6767132e530", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-09-23T17:18:33+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-09-23T17:18:33+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua Smart Park Integrated Management Platform | Class: device-management-platform | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7309", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7309"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Dahua", "30d_avg": 0, "90d_avg": 0, "product": "Dahua Smart Park Integrated Management Platform", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "76beb4be-0670-407f-b00c-dfa05fa1b04c", "vulnerability": {"vulnId": "CVE-2021-33544", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "76beb4be-0670-407f-b00c-dfa05fa1b04c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-13T16:02:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:02:46+00:00"}, "scope": {"notes": "Affected: UDP Technology / video camera firmware for multiple vendors | Class: video-system | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-33544", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33544"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "UDP Technology", "30d_avg": 1, "90d_avg": 2, "product": "video camera firmware for multiple vendors", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "098cabb7-254d-4952-9935-25b48854d417", "vulnerability": {"vulnId": "CVE-2024-48766", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "098cabb7-254d-4952-9935-25b48854d417", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-05-12T13:24:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-12T13:24:50+00:00"}, "scope": {"notes": "Affected: NetAlertX / NetAlertX | Class: network-monitoring | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-48766", "url": "https://www.cve.org/CVERecord?id=CVE-2024-48766"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "NetAlertX", "30d_avg": 0, "90d_avg": 2, "product": "NetAlertX", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "aff26c15-ced1-4e52-9e8d-932bea00b6a1", "vulnerability": {"vulnId": "CVE-2019-18394", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aff26c15-ced1-4e52-9e8d-932bea00b6a1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:08+00:00"}, "scope": {"notes": "Affected: Ignite Realtime / Openfire | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18394", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18394"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Ignite Realtime", "30d_avg": 0, "90d_avg": 2, "product": "Openfire", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ae149647-44f6-408b-9508-a0b53e79a809", "vulnerability": {"vulnId": "CVE-2025-54236", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ae149647-44f6-408b-9508-a0b53e79a809", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-27T18:42:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-27T18:42:11+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Commerce (Magento) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54236", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54236"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 1, "product": "Adobe Commerce (Magento)", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "765f24da-805d-436b-8555-8110c47c9427", "vulnerability": {"vulnId": "CVE-2024-5827", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "765f24da-805d-436b-8555-8110c47c9427", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-12-05T06:27:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:28+00:00"}, "scope": {"notes": "Affected: Vanna / Vanna | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-5827", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5827"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "Vanna", "30d_avg": 4, "90d_avg": 4, "product": "Vanna", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "dd349dac-001d-4653-88e2-e7c3f1b60dae", "vulnerability": {"vulnId": "CVE-2023-34993", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dd349dac-001d-4653-88e2-e7c3f1b60dae", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-14T19:21:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-14T19:21:36+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiWLM | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34993", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34993"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Fortinet", "30d_avg": 0, "90d_avg": 2, "product": "FortiWLM", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1f609d7f-313e-478f-ab05-087ff4c09b8e", "vulnerability": {"vulnId": "CVE-2018-1000130", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1f609d7f-313e-478f-ab05-087ff4c09b8e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-10-14T20:53:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:19+00:00"}, "scope": {"notes": "Affected: Jolokia / Jolokia | Class: other-software | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-1000130", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000130"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Jolokia", "30d_avg": 1, "90d_avg": 2, "product": "Jolokia", "cisa_kev": "no", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "6c91afea-d86d-4505-bc1f-afbb238f670e", "vulnerability": {"vulnId": "CVE-2023-49785", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6c91afea-d86d-4505-bc1f-afbb238f670e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2024-04-06T13:53:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-06T13:53:20+00:00"}, "scope": {"notes": "Affected: NextChat (ChatGPT-Next-Web) / NextChat (ChatGPT-Next-Web) | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-49785", "url": "https://www.cve.org/CVERecord?id=CVE-2023-49785"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "NextChat (ChatGPT-Next-Web)", "30d_avg": 5, "90d_avg": 4, "product": "NextChat (ChatGPT-Next-Web)", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "64701c03-2a8d-498c-bde5-c33adbd62722", "vulnerability": {"vulnId": "CVE-2021-40438", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "64701c03-2a8d-498c-bde5-c33adbd62722", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 90}, "timestamps": {"asserted_at": "2023-10-14T17:31:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:31:29+00:00"}, "scope": {"notes": "Affected: Apache / Apache HTTP Server | Class: web-server | Severity: Critical (CVSS 9) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-40438", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40438"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "Apache HTTP Server", "cisa_kev": "yes", "connections": 51, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9, "vulnerability_severity": "Critical"}}]}
{"uuid": "9a638ba0-d14b-4c1e-ba04-e7058778c9d0", "vulnerability": {"vulnId": "CVE-2018-25124", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9a638ba0-d14b-4c1e-ba04-e7058778c9d0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:41:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:41:42+00:00"}, "scope": {"notes": "Affected: RainbowFish Software / PacsOne Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-25124", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25124"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "RainbowFish Software", "30d_avg": 0, "90d_avg": 0, "product": "PacsOne Server", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "67b161ab-5a0f-48e7-ac6d-58d53d03f1ed", "vulnerability": {"vulnId": "CVE-2022-26833", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "67b161ab-5a0f-48e7-ac6d-58d53d03f1ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 94}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Open Automation Software / OAS Platform | Class: other-software | Severity: Critical (CVSS 9.4) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-26833", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26833"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Open Automation Software", "30d_avg": 1, "90d_avg": 2, "product": "OAS Platform", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.4, "vulnerability_severity": "Critical"}}]}
{"uuid": "7e4af14c-b87b-44b2-b216-2e2f37024030", "vulnerability": {"vulnId": "CVE-2022-0786", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7e4af14c-b87b-44b2-b216-2e2f37024030", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:13:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:13:03+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress KiviCare plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0786", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0786"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress KiviCare plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "26ce9d54-eb6c-4a6e-80b7-4fe77512418e", "vulnerability": {"vulnId": "CVE-2022-0952", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "26ce9d54-eb6c-4a6e-80b7-4fe77512418e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:35+00:00"}, "scope": {"notes": "Affected: Wordpress / Sitemap by click5 WordPress plugin | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0952"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Sitemap by click5 WordPress plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "825386f0-b88e-4c18-a2dc-7193dc96f063", "vulnerability": {"vulnId": "CVE-2018-0127", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "825386f0-b88e-4c18-a2dc-7193dc96f063", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:29:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:29:43+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV132W/RV134W | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-0127", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0127"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 2, "product": "Cisco RV132W/RV134W", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2e508f1a-2bd7-4438-8a69-00f81e37fc02", "vulnerability": {"vulnId": "CVE-2024-7954", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e508f1a-2bd7-4438-8a69-00f81e37fc02", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-22T13:59:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-22T13:59:53+00:00"}, "scope": {"notes": "Affected: SPIP / SPIP | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7954", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7954"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "SPIP", "30d_avg": 1, "90d_avg": 2, "product": "SPIP", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "90927b06-be67-4b01-b8b5-57e06f5f5847", "vulnerability": {"vulnId": "CVE-2020-12641", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "90927b06-be67-4b01-b8b5-57e06f5f5847", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-05T02:43:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-05T02:43:14+00:00"}, "scope": {"notes": "Affected: Roundcube / Roundcube Webmail | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-12641", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12641"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Roundcube", "30d_avg": 5, "90d_avg": 4, "product": "Roundcube Webmail", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bf378308-331e-4be1-a68c-e6d3f070343c", "vulnerability": {"vulnId": "CVE-2022-25369", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bf378308-331e-4be1-a68c-e6d3f070343c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Dynamicweb Software / Dynamicweb | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25369", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25369"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Dynamicweb Software", "30d_avg": 0, "90d_avg": 1, "product": "Dynamicweb", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "c0bf821e-d5b7-4b2f-8531-453c0b9566ea", "vulnerability": {"vulnId": "CVE-2019-17270", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c0bf821e-d5b7-4b2f-8531-453c0b9566ea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:07+00:00"}, "scope": {"notes": "Affected: Yachtcontrol / Yachtcontrol | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-17270", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17270"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Yachtcontrol", "30d_avg": 0, "90d_avg": 1, "product": "Yachtcontrol", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5ac98bf8-b7f1-4522-ad34-3fe888790285", "vulnerability": {"vulnId": "CVE-2024-45507", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5ac98bf8-b7f1-4522-ad34-3fe888790285", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T06:27:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:27+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 29", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-45507", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45507"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "OFBiz", "cisa_kev": "no", "connections": 29, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "58400391-ca7d-4d81-a25d-1c80414be6b6", "vulnerability": {"vulnId": "CVE-2021-20124", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "58400391-ca7d-4d81-a25d-1c80414be6b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-03T21:53:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-03T21:53:03+00:00"}, "scope": {"notes": "Affected: Draytek / VigorConnect | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20124", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20124"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Draytek", "30d_avg": 5, "90d_avg": 4, "product": "VigorConnect", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "7c45d69e-e1c9-46de-8bfd-98d1dfd7ade9", "vulnerability": {"vulnId": "CVE-2024-27564", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7c45d69e-e1c9-46de-8bfd-98d1dfd7ade9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-04-27T04:54:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-27T04:54:55+00:00"}, "scope": {"notes": "Affected: dirk1983 / chatgpt | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27564", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27564"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "dirk1983", "30d_avg": 4, "90d_avg": 3, "product": "chatgpt", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "3ab9900b-9a75-460a-8e59-9edc1c7c1ae8", "vulnerability": {"vulnId": "CVE-2022-34121", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3ab9900b-9a75-460a-8e59-9edc1c7c1ae8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:35+00:00"}, "scope": {"notes": "Affected: CuppaCMS / CuppaCMS | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-34121", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34121"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "CuppaCMS", "30d_avg": 1, "90d_avg": 2, "product": "CuppaCMS", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "b850d0bc-309b-4fbf-b853-2a4438589136", "vulnerability": {"vulnId": "CVE-2024-9047", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b850d0bc-309b-4fbf-b853-2a4438589136", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-21T10:21:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-21T10:21:42+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress File Upload plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9047", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9047"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress File Upload plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ecf23cb2-c4aa-4161-9803-bb2a8167e578", "vulnerability": {"vulnId": "CVE-2019-20933", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ecf23cb2-c4aa-4161-9803-bb2a8167e578", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:10+00:00"}, "scope": {"notes": "Affected: InfluxData / InfluxDB | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-20933", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20933"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "InfluxData", "30d_avg": 0, "90d_avg": 1, "product": "InfluxDB", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0d55a77e-3ea6-41e1-adbe-34e198abe8fc", "vulnerability": {"vulnId": "CVE-2021-24915", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0d55a77e-3ea6-41e1-adbe-34e198abe8fc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:37+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Contest Gallery plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24915", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24915"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Contest Gallery plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6355e224-637a-4be3-bed9-ec8c60e2ab56", "vulnerability": {"vulnId": "CVE-2022-24716", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6355e224-637a-4be3-bed9-ec8c60e2ab56", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:41+00:00"}, "scope": {"notes": "Affected: Icinga / Icinga Web 2 | Class: network-monitoring | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24716", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24716"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "Icinga", "30d_avg": 4, "90d_avg": 3, "product": "Icinga Web 2", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c0e21c9a-e132-4ddb-9f13-6bb599adc226", "vulnerability": {"vulnId": "CVE-2023-29300", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c0e21c9a-e132-4ddb-9f13-6bb599adc226", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:48+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-29300", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29300"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "Adobe", "30d_avg": 1, "90d_avg": 2, "product": "ColdFusion", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ff865fb-de7f-456f-8e97-1bd5e9613f52", "vulnerability": {"vulnId": "CVE-2021-27358", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ff865fb-de7f-456f-8e97-1bd5e9613f52", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T17:07:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-01T17:07:58+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27358", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27358"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 1, "vendor": "Grafana", "30d_avg": 1, "90d_avg": 2, "product": "Grafana", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "f030d1f0-2995-49b8-aebd-1f2421207a3a", "vulnerability": {"vulnId": "CVE-2022-38627", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f030d1f0-2995-49b8-aebd-1f2421207a3a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:15:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-13T16:15:17+00:00"}, "scope": {"notes": "Affected: Linear / eMerge E3-series | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-38627", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38627"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Linear", "30d_avg": 0, "90d_avg": 1, "product": "eMerge E3-series", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1eeefc53-90ed-4fdd-8517-a319905a5d9e", "vulnerability": {"vulnId": "CVE-2025-25037", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1eeefc53-90ed-4fdd-8517-a319905a5d9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-18T05:25:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T05:25:24+00:00"}, "scope": {"notes": "Affected: Aquatronica / Aquatronica Control System | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-25037", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25037"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Aquatronica", "30d_avg": 1, "90d_avg": 2, "product": "Aquatronica Control System", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2d8ed31c-dd94-4846-bb21-b056b6d8141a", "vulnerability": {"vulnId": "CVE-2022-21500", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2d8ed31c-dd94-4846-bb21-b056b6d8141a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:25+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle E-Business Suite | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-21500", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21500"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 4, "90d_avg": 3, "product": "Oracle E-Business Suite", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "56de78ac-b3e9-4f22-8e54-7eb92036b16a", "vulnerability": {"vulnId": "CVE-2019-3929", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "56de78ac-b3e9-4f22-8e54-7eb92036b16a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:12+00:00"}, "scope": {"notes": "Affected: Barco/AWIND / Barco/AWIND OEM | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-3929", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3929"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 1, "vendor": "Barco/AWIND", "30d_avg": 1, "90d_avg": 2, "product": "Barco/AWIND OEM", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "81cc9dbf-4704-4209-9bfc-e3171416c735", "vulnerability": {"vulnId": "CVE-2021-21985", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "81cc9dbf-4704-4209-9bfc-e3171416c735", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: VMware / vCenter | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21985", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21985"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "VMware", "30d_avg": 1, "90d_avg": 2, "product": "vCenter", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b2564c9f-66db-404c-b067-8c330007ade5", "vulnerability": {"vulnId": "CVE-2023-7334", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b2564c9f-66db-404c-b067-8c330007ade5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-01-17T03:38:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-17T03:38:41+00:00"}, "scope": {"notes": "Affected: Changjetong / Changjetong T+ | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7334", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7334"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Changjetong", "30d_avg": 1, "90d_avg": 1, "product": "Changjetong T+", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "2915298e-551c-4de2-b7e0-9720c74c4c9e", "vulnerability": {"vulnId": "CVE-2018-7841", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2915298e-551c-4de2-b7e0-9720c74c4c9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-24T04:56:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-24T04:56:24+00:00"}, "scope": {"notes": "Affected: Schneider Electric / Schneider Electric U.Motion Builder | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-7841", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7841"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Schneider Electric", "30d_avg": 1, "90d_avg": 2, "product": "Schneider Electric U.Motion Builder", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cc0e2214-e7e0-4c19-af27-4b813a1f7a83", "vulnerability": {"vulnId": "CVE-2021-26084", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc0e2214-e7e0-4c19-af27-4b813a1f7a83", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T16:40:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T16:40:42+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 105", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-26084", "url": "https://www.cve.org/CVERecord?id=CVE-2021-26084"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 7, "vendor": "Atlassian", "30d_avg": 6, "90d_avg": 10, "product": "Confluence", "cisa_kev": "yes", "connections": 105, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0f9bbc03-55d6-4036-bbc0-b6a554c7855b", "vulnerability": {"vulnId": "CVE-2021-22502", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f9bbc03-55d6-4036-bbc0-b6a554c7855b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Micro Focus / Operations Bridge Reporter (OBR) | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22502", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22502"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 3, "vendor": "Micro Focus", "30d_avg": 3, "90d_avg": 3, "product": "Operations Bridge Reporter (OBR)", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e964153f-0f48-4633-9400-663fa812d463", "vulnerability": {"vulnId": "CVE-2021-24284", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e964153f-0f48-4633-9400-663fa812d463", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:50+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Kaswara Modern VC Addons plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24284", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24284"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Kaswara Modern VC Addons plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f75d786c-dffd-4dd2-b9b7-b27d5f232b54", "vulnerability": {"vulnId": "CVE-2023-3793", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f75d786c-dffd-4dd2-b9b7-b27d5f232b54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-26T02:13:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-26T02:13:53+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3793", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "19f681c5-0336-4922-8fb6-a760a40f204e", "vulnerability": {"vulnId": "CVE-2024-37032", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "19f681c5-0336-4922-8fb6-a760a40f204e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-08-22T07:13:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-22T07:13:35+00:00"}, "scope": {"notes": "Affected: Ollama / Ollama | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-37032", "url": "https://www.cve.org/CVERecord?id=CVE-2024-37032"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Ollama", "30d_avg": 1, "90d_avg": 2, "product": "Ollama", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "0334b48e-01f0-4e38-bd47-70a8dd7d979b", "vulnerability": {"vulnId": "CVE-2018-11222", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0334b48e-01f0-4e38-bd47-70a8dd7d979b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:55:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:27+00:00"}, "scope": {"notes": "Affected: Artica / Pandora FMS | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11222", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11222"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Artica", "30d_avg": 0, "90d_avg": 1, "product": "Pandora FMS", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2b70c331-c78c-4fda-9c12-82ae5819dc9e", "vulnerability": {"vulnId": "CVE-2025-30567", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2b70c331-c78c-4fda-9c12-82ae5819dc9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-16T09:04:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-16T09:04:08+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WP01 plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-30567", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30567"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 2, "90d_avg": 2, "product": "Wordpress WP01 plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e4f954fd-0c06-47a3-88ca-1ff477ff1c33", "vulnerability": {"vulnId": "CVE-2017-18349", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e4f954fd-0c06-47a3-88ca-1ff477ff1c33", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T21:36:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T21:36:53+00:00"}, "scope": {"notes": "Affected: Alibaba / Fastjson | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-18349", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18349"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Alibaba", "30d_avg": 0, "90d_avg": 0, "product": "Fastjson", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c081f3db-2a39-4d30-95b6-929b9895f1ff", "vulnerability": {"vulnId": "CVE-2022-0747", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c081f3db-2a39-4d30-95b6-929b9895f1ff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:28:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:28:13+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Infographic Maker plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0747", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0747"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Infographic Maker plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8c2236b0-4fd4-4c57-a960-b3ac1ecfdc6c", "vulnerability": {"vulnId": "CVE-2020-13379", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8c2236b0-4fd4-4c57-a960-b3ac1ecfdc6c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2024-03-07T21:04:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-07T21:04:13+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13379"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 0, "vendor": "Grafana", "30d_avg": 5, "90d_avg": 4, "product": "Grafana", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "240053fd-b6d6-4708-b506-359dd3b2da54", "vulnerability": {"vulnId": "CVE-2022-36642", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "240053fd-b6d6-4708-b506-359dd3b2da54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:37+00:00"}, "scope": {"notes": "Affected: Telos Alliance / Omnia MPX Node | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36642", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36642"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Telos Alliance", "30d_avg": 5, "90d_avg": 4, "product": "Omnia MPX Node", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7c918918-8206-49d6-88b8-bdafbf938594", "vulnerability": {"vulnId": "CVE-2023-4169", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7c918918-8206-49d6-88b8-bdafbf938594", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-12-01T04:16:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-01T04:16:55+00:00"}, "scope": {"notes": "Affected: Ruijie / Ruijie RG-EW1200G | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4169", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4169"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Ruijie", "30d_avg": 1, "90d_avg": 2, "product": "Ruijie RG-EW1200G", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "a21fb408-5b02-4ec3-90b9-960396f5ca57", "vulnerability": {"vulnId": "CVE-2024-29824", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a21fb408-5b02-4ec3-90b9-960396f5ca57", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 96}, "timestamps": {"asserted_at": "2024-06-19T03:03:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-19T03:03:18+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: Critical (CVSS 9.6) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-29824", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29824"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 1, "90d_avg": 2, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.6, "vulnerability_severity": "Critical"}}]}
{"uuid": "621393ec-1878-49ef-9d70-969fb54b46be", "vulnerability": {"vulnId": "CVE-2023-3368", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "621393ec-1878-49ef-9d70-969fb54b46be", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T12:09:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T12:09:19+00:00"}, "scope": {"notes": "Affected: Chamilo / Chamilo | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3368", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3368"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Chamilo", "30d_avg": 1, "90d_avg": 2, "product": "Chamilo", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "98d99d17-5c57-4172-9882-c1c37fc74e55", "vulnerability": {"vulnId": "CVE-2022-23347", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "98d99d17-5c57-4172-9882-c1c37fc74e55", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:28+00:00"}, "scope": {"notes": "Affected: BigAnt Software / BigAnt Server | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-23347", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23347"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "BigAnt Software", "30d_avg": 0, "90d_avg": 1, "product": "BigAnt Server", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "7f8189cd-bafd-40f6-b54a-d2724a363419", "vulnerability": {"vulnId": "CVE-2024-4885", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f8189cd-bafd-40f6-b54a-d2724a363419", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-06T02:47:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-06T02:47:11+00:00"}, "scope": {"notes": "Affected: Progress / WhatsUp Gold | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4885", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4885"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Progress", "30d_avg": 1, "90d_avg": 2, "product": "WhatsUp Gold", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ae45d364-f1b7-4aeb-9119-378e07ee8d63", "vulnerability": {"vulnId": "CVE-2024-1561", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ae45d364-f1b7-4aeb-9119-378e07ee8d63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-18T08:57:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-18T08:57:55+00:00"}, "scope": {"notes": "Affected: Gradio / Gradio | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1561", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1561"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "Gradio", "30d_avg": 5, "90d_avg": 4, "product": "Gradio", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9917a2c2-1c16-4575-b93c-00e8a0e24939", "vulnerability": {"vulnId": "CVE-2017-9841", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9917a2c2-1c16-4575-b93c-00e8a0e24939", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:00:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:00+00:00"}, "scope": {"notes": "Affected: PHPUnit - Sebastian Bergmann / PHPUnit | Class: other-software | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1187", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-9841", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9841"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "166", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 198, "vendor": "PHPUnit - Sebastian Bergmann", "30d_avg": 220, "90d_avg": 234, "product": "PHPUnit", "cisa_kev": "yes", "connections": 1187, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a8a9131a-c06e-4186-ab50-2d262b99c85b", "vulnerability": {"vulnId": "CVE-2022-1006", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a8a9131a-c06e-4186-ab50-2d262b99c85b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2025-07-20T12:58:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-20T12:58:50+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Advanced Booking Calendar plugin | Class: cms | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1006", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1006"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Advanced Booking Calendar plugin", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "94f4438a-e0b9-4f70-a912-1287d4faaa68", "vulnerability": {"vulnId": "CVE-2018-0296", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "94f4438a-e0b9-4f70-a912-1287d4faaa68", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T20:53:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:19+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ASA and Cisco Firepower Threat Defense | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-0296", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0296"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 2, "product": "Cisco ASA and Cisco Firepower Threat Defense", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a645c8e9-d321-40f7-8167-b8813d4f13a6", "vulnerability": {"vulnId": "CVE-2022-4050", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a645c8e9-d321-40f7-8167-b8813d4f13a6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress JoomSport plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4050", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4050"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress JoomSport plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5dc50df8-eecf-4e16-bea5-6b5f19456a4d", "vulnerability": {"vulnId": "CVE-2020-35665", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5dc50df8-eecf-4e16-bea5-6b5f19456a4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: TerraMaster / TOS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35665", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35665"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "TerraMaster", "30d_avg": 4, "90d_avg": 4, "product": "TOS", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4bc5663d-b4b8-42fe-9d8d-13ce4c4f111a", "vulnerability": {"vulnId": "CVE-2023-39026", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4bc5663d-b4b8-42fe-9d8d-13ce4c4f111a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-19T00:13:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T00:13:41+00:00"}, "scope": {"notes": "Affected: FileMage / FileMage Gateway | Class: file-transfer | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-39026", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39026"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "FileMage", "30d_avg": 0, "90d_avg": 1, "product": "FileMage Gateway", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "25f2d139-d446-4d9f-b52d-4b9880673571", "vulnerability": {"vulnId": "CVE-2018-18852", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "25f2d139-d446-4d9f-b52d-4b9880673571", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-08-15T08:02:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-15T08:02:00+00:00"}, "scope": {"notes": "Affected: CERIO / CERIO DT-300N | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-18852", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18852"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "CERIO", "30d_avg": 0, "90d_avg": 0, "product": "CERIO DT-300N", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "7f926889-572c-4f08-a0bf-23ae4d4b4eaf", "vulnerability": {"vulnId": "CVE-2023-31465", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f926889-572c-4f08-a0bf-23ae4d4b4eaf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-15T03:36:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-15T03:36:06+00:00"}, "scope": {"notes": "Affected: FSMLabs / TimeKeeper | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-31465", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31465"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "FSMLabs", "30d_avg": 1, "90d_avg": 2, "product": "TimeKeeper", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8641b204-6fac-4461-b005-52153089ba41", "vulnerability": {"vulnId": "CVE-2021-4458", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8641b204-6fac-4461-b005-52153089ba41", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:34+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Modern Events Calendar Lite plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-4458", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4458"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Modern Events Calendar Lite plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fcbc152c-c5ca-4367-a081-6d259a3e0933", "vulnerability": {"vulnId": "CVE-2022-45835", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fcbc152c-c5ca-4367-a081-6d259a3e0933", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-12-05T06:27:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:19+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress PhonePe Payment Solutions plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-45835", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45835"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress PhonePe Payment Solutions plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "40f86342-5eec-48d4-bfcb-01eb2064e329", "vulnerability": {"vulnId": "CVE-2024-32735", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "40f86342-5eec-48d4-bfcb-01eb2064e329", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-01-22T16:42:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:42:58+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 34", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32735", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32735"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "CyberPanel", "30d_avg": 1, "90d_avg": 2, "product": "CyberPanel", "cisa_kev": "no", "connections": 34, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a83ea014-f411-4b35-927a-1e04c35dc322", "vulnerability": {"vulnId": "CVE-2022-29383", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a83ea014-f411-4b35-927a-1e04c35dc322", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:30+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR ProSafe FVS336Gv2/FVS336Gv3 | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29383", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29383"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "NETGEAR", "30d_avg": 1, "90d_avg": 2, "product": "NETGEAR ProSafe FVS336Gv2/FVS336Gv3", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ec04d313-da4c-4c55-a472-e1142c7111f5", "vulnerability": {"vulnId": "CVE-2023-0669", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ec04d313-da4c-4c55-a472-e1142c7111f5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:42+00:00"}, "scope": {"notes": "Affected: Fortra / GoAnywhere MFT | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0669", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0669"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Fortra", "30d_avg": 1, "90d_avg": 2, "product": "GoAnywhere MFT", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "feffcc67-4934-4828-8178-8cbc0e351ac0", "vulnerability": {"vulnId": "CVE-2024-0692", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "feffcc67-4934-4828-8178-8cbc0e351ac0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-08-23T23:07:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-23T23:07:01+00:00"}, "scope": {"notes": "Affected: SolarWinds / SolarWinds Security Event Manager | Class: security-management-platform | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0692", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0692"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "SolarWinds", "30d_avg": 4, "90d_avg": 3, "product": "SolarWinds Security Event Manager", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "08982335-5a41-446f-a77a-dbf6143c7a45", "vulnerability": {"vulnId": "CVE-2024-44849", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "08982335-5a41-446f-a77a-dbf6143c7a45", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-08T08:16:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-10-08T08:16:07+00:00"}, "scope": {"notes": "Affected: Qualitor / Qualitor ITSM | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-44849", "url": "https://www.cve.org/CVERecord?id=CVE-2024-44849"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Qualitor", "30d_avg": 5, "90d_avg": 3, "product": "Qualitor ITSM", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "083ff118-06a1-4029-a752-d11f6d28116f", "vulnerability": {"vulnId": "CVE-2023-6266", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "083ff118-06a1-4029-a752-d11f6d28116f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T18:17:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-01T18:17:15+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Backup Migration plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6266", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6266"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Backup Migration plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "43abf3ca-5b0d-4d5c-bca4-429b01768b75", "vulnerability": {"vulnId": "CVE-2024-9193", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "43abf3ca-5b0d-4d5c-bca4-429b01768b75", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-20T15:41:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-20T15:41:28+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WHMpress - WHMCS WordPress Integration Plugin plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9193", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9193"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress WHMpress - WHMCS WordPress Integration Plugin plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7f357946-c679-4cd3-906d-22bade83fc7c", "vulnerability": {"vulnId": "CVE-2022-31161", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f357946-c679-4cd3-906d-22bade83fc7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-03T17:48:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-03T17:48:51+00:00"}, "scope": {"notes": "Affected: Roxy-WI / Roxy-WI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31161", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31161"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Roxy-WI", "30d_avg": 1, "90d_avg": 2, "product": "Roxy-WI", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4f4342aa-113e-48f9-b195-39c1ee4aca60", "vulnerability": {"vulnId": "CVE-2025-2825", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4f4342aa-113e-48f9-b195-39c1ee4aca60", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-30T01:07:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-30T01:07:37+00:00"}, "scope": {"notes": "Affected: CrushFTP / CrushFTP | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-2825", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2825"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 6, "vendor": "CrushFTP", "30d_avg": 7, "90d_avg": 5, "product": "CrushFTP", "cisa_kev": "no", "connections": 14, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "647d79f6-1ed7-4a17-b97d-857a3695a459", "vulnerability": {"vulnId": "CVE-2021-27561", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "647d79f6-1ed7-4a17-b97d-857a3695a459", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:17:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:17:18+00:00"}, "scope": {"notes": "Affected: Yealink / Yealink Device Management (DM) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27561", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27561"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Yealink", "30d_avg": 0, "90d_avg": 2, "product": "Yealink Device Management (DM)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e8f21649-ee63-4354-80c2-27371a7d731b", "vulnerability": {"vulnId": "CVE-2020-20300", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e8f21649-ee63-4354-80c2-27371a7d731b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-28T06:31:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-28T06:31:59+00:00"}, "scope": {"notes": "Affected: WeiPHP / WeiPHP | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-20300", "url": "https://www.cve.org/CVERecord?id=CVE-2020-20300"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "WeiPHP", "30d_avg": 0, "90d_avg": 1, "product": "WeiPHP", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e3cd1fc3-eff5-4b9b-8dec-edce1a45c034", "vulnerability": {"vulnId": "CVE-2024-25852", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e3cd1fc3-eff5-4b9b-8dec-edce1a45c034", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-09-25T12:18:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-25T12:18:32+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys RE7000 | Class: wireless-extender | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-25852", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25852"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 1, "vendor": "Linksys", "30d_avg": 1, "90d_avg": 1, "product": "Linksys RE7000", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "734e79df-06e5-453c-a15c-5c51564c401e", "vulnerability": {"vulnId": "CVE-2017-8961", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "734e79df-06e5-453c-a15c-5c51564c401e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-08-15T08:02:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-15T08:02:21+00:00"}, "scope": {"notes": "Affected: HPE / HPE intelligent Management Center (iMC) PLAT | Class: device-management-platform | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-8961", "url": "https://www.cve.org/CVERecord?id=CVE-2017-8961"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HPE", "30d_avg": 0, "90d_avg": 0, "product": "HPE intelligent Management Center (iMC) PLAT", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "e881fc8a-c9e2-4de9-b55a-f24bf107d987", "vulnerability": {"vulnId": "CVE-2021-20166", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e881fc8a-c9e2-4de9-b55a-f24bf107d987", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:47+00:00"}, "scope": {"notes": "Affected: NETGEAR / RAX43 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20166", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20166"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 1, "90d_avg": 2, "product": "RAX43", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "c6c25b40-7422-4448-aa8d-faf53c12539b", "vulnerability": {"vulnId": "CVE-2022-38840", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c6c25b40-7422-4448-aa8d-faf53c12539b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-21T01:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-21T01:57:26+00:00"}, "scope": {"notes": "Affected: Guralp / Guralp MAN-EAM-0003 | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-38840", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38840"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Guralp", "30d_avg": 0, "90d_avg": 2, "product": "Guralp MAN-EAM-0003", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e8352c15-e573-428b-b770-5ba454930ff4", "vulnerability": {"vulnId": "CVE-2023-4450", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e8352c15-e573-428b-b770-5ba454930ff4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-06T02:35:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-06T02:35:03+00:00"}, "scope": {"notes": "Affected: JEECG / jeecg-boot | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4450", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4450"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "JEECG", "30d_avg": 1, "90d_avg": 2, "product": "jeecg-boot", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5c19001d-1895-4108-a572-8a4a1148d32e", "vulnerability": {"vulnId": "CVE-2023-47248", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5c19001d-1895-4108-a572-8a4a1148d32e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-16T08:23:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-16T08:23:43+00:00"}, "scope": {"notes": "Affected: Apache / Arrow | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 34", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-47248", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47248"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "Arrow", "cisa_kev": "no", "connections": 34, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f4634548-3abf-4f83-8455-e96036143c96", "vulnerability": {"vulnId": "CVE-2021-21315", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f4634548-3abf-4f83-8455-e96036143c96", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2023-10-14T14:56:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:47+00:00"}, "scope": {"notes": "Affected: Node.js / Node.js | Class: other-software | Severity: High (CVSS 7.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21315", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21315"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Node.js", "30d_avg": 0, "90d_avg": 1, "product": "Node.js", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "e9b08fd8-d9c8-4bab-9fb8-80910f13fbb5", "vulnerability": {"vulnId": "CVE-2024-8752", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e9b08fd8-d9c8-4bab-9fb8-80910f13fbb5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-10-07T11:45:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-10-07T11:45:01+00:00"}, "scope": {"notes": "Affected: WebIQ / WebIQ | Class: cms | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8752", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8752"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "WebIQ", "30d_avg": 0, "90d_avg": 1, "product": "WebIQ", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "fc2bf820-a58d-4a5b-9b59-c01119b09188", "vulnerability": {"vulnId": "CVE-2022-4059", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fc2bf820-a58d-4a5b-9b59-c01119b09188", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T15:35:33+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-30T15:35:33+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Cryptocurrency Widgets Pack plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4059", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Cryptocurrency Widgets Pack plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "86ff8674-0191-4ea3-b995-b4132387320a", "vulnerability": {"vulnId": "CVE-2025-34067", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "86ff8674-0191-4ea3-b995-b4132387320a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T16:54:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T16:54:43+00:00"}, "scope": {"notes": "Affected: Hikvision / Management-Platform | Class: device-management-platform | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34067", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34067"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Management-Platform", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "d173e9c7-f76f-47ab-ae69-58d7a47a8636", "vulnerability": {"vulnId": "CVE-2020-10148", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d173e9c7-f76f-47ab-ae69-58d7a47a8636", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: SolarWinds / SolarWinds Orion | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10148", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10148"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "SolarWinds", "30d_avg": 4, "90d_avg": 3, "product": "SolarWinds Orion", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d0df6530-c91e-4c84-b3ed-1408ba2d0561", "vulnerability": {"vulnId": "CVE-2019-7254", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d0df6530-c91e-4c84-b3ed-1408ba2d0561", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: Linear / eMerge E3-Series | Class: other-software | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-7254", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7254"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Linear", "30d_avg": 4, "90d_avg": 3, "product": "eMerge E3-Series", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "d6e4d0be-77f5-4ff3-8c5e-199028ef4a1b", "vulnerability": {"vulnId": "CVE-2009-0545", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d6e4d0be-77f5-4ff3-8c5e-199028ef4a1b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T13:53:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T13:53:04+00:00"}, "scope": {"notes": "Affected: Zeroshell / Zeroshell Linux Router | Class: embedded-system | Severity: High (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2009-0545", "url": "https://www.cve.org/CVERecord?id=CVE-2009-0545"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Zeroshell", "30d_avg": 4, "90d_avg": 3, "product": "Zeroshell Linux Router", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "High"}}]}
{"uuid": "63b1481f-5d1e-4f50-afcf-394893e23e56", "vulnerability": {"vulnId": "CVE-2024-27954", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "63b1481f-5d1e-4f50-afcf-394893e23e56", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-29T18:41:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-29T18:41:22+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Automatic plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27954", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27954"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Automatic plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "32f946d3-99f2-4aa8-b646-cc9caeb73e0a", "vulnerability": {"vulnId": "CVE-2021-30118", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "32f946d3-99f2-4aa8-b646-cc9caeb73e0a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-23T03:28:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-23T03:28:19+00:00"}, "scope": {"notes": "Affected: Kaseya / VSA | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-30118", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30118"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Kaseya", "30d_avg": 1, "90d_avg": 3, "product": "VSA", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f2189a91-8d15-4f52-a745-318ef7fab2b8", "vulnerability": {"vulnId": "CVE-2024-27956", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2189a91-8d15-4f52-a745-318ef7fab2b8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T06:27:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Automatic plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27956", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27956"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress Automatic plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ca4c2094-3c47-49af-866b-1acdf8345f24", "vulnerability": {"vulnId": "CVE-2025-47188", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ca4c2094-3c47-49af-866b-1acdf8345f24", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-01-28T06:25:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-28T06:25:40+00:00"}, "scope": {"notes": "Affected: Mitel / Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, 6970 Conference Unit | Class: voip | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-47188", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47188"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Mitel", "30d_avg": 0, "90d_avg": 0, "product": "Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, 6970 Conference Unit", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "d437400e-37e1-4446-adca-0ef52e5f4538", "vulnerability": {"vulnId": "CVE-2022-0826", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d437400e-37e1-4446-adca-0ef52e5f4538", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WP Video Gallery plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0826", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0826"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress WP Video Gallery plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "885984d4-c310-45fe-a30b-677a98f3f09d", "vulnerability": {"vulnId": "CVE-2024-1698", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "885984d4-c310-45fe-a30b-677a98f3f09d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-29T18:41:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-29T18:41:21+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress NotificationX plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1698", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1698"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress NotificationX plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5b2989c3-4175-42d2-9718-eca38f7a3153", "vulnerability": {"vulnId": "CVE-2023-5815", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5b2989c3-4175-42d2-9718-eca38f7a3153", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-21T21:31:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-21T21:31:41+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress News & Blog Designer Pack plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5815", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5815"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress News & Blog Designer Pack plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ee5ef8c-7524-441b-84c7-a4c27bc7d786", "vulnerability": {"vulnId": "CVE-2020-10548", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ee5ef8c-7524-441b-84c7-a4c27bc7d786", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:16+00:00"}, "scope": {"notes": "Affected: rConfig / rConfig | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10548", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10548"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "rConfig", "30d_avg": 0, "90d_avg": 1, "product": "rConfig", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2e05be86-285f-479a-8d53-a7fadfe1e4c2", "vulnerability": {"vulnId": "CVE-2021-45967", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e05be86-285f-479a-8d53-a7fadfe1e4c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:55:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:55:59+00:00"}, "scope": {"notes": "Affected: Pascom / Pascom Cloud Phone System | Class: ip-pbx | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-45967", "url": "https://www.cve.org/CVERecord?id=CVE-2021-45967"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "Pascom", "30d_avg": 0, "90d_avg": 1, "product": "Pascom Cloud Phone System", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3ec0e25d-dc97-4167-bfeb-470dc172c109", "vulnerability": {"vulnId": "CVE-2022-1574", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3ec0e25d-dc97-4167-bfeb-470dc172c109", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-18T08:50:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-18T08:50:24+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress HTML2WP plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1574", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1574"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 3, "product": "Wordpress HTML2WP plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9dc744c5-b7d0-4d02-a2e1-7f9473808939", "vulnerability": {"vulnId": "CVE-2024-29895", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9dc744c5-b7d0-4d02-a2e1-7f9473808939", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-06T02:53:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-06T02:53:16+00:00"}, "scope": {"notes": "Affected: Cacti / Cacti | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-29895", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29895"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "Cacti", "30d_avg": 0, "90d_avg": 1, "product": "Cacti", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3da1d6bd-2898-4f47-86ad-557d63614b39", "vulnerability": {"vulnId": "CVE-2018-16159", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3da1d6bd-2898-4f47-86ad-557d63614b39", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:39:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:39:17+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Gift Voucher plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 25", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-16159", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16159"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Gift Voucher plugin", "cisa_kev": "no", "connections": 25, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "66e5dea5-1194-4135-a554-73207d2c2bf0", "vulnerability": {"vulnId": "CVE-2020-35131", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "66e5dea5-1194-4135-a554-73207d2c2bf0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: Cockpit / Cockpit | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35131", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35131"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 3, "vendor": "Cockpit", "30d_avg": 11, "90d_avg": 8, "product": "Cockpit", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6c8bf1e4-7ebc-4341-b407-685472342c2e", "vulnerability": {"vulnId": "CVE-2022-36923", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6c8bf1e4-7ebc-4341-b407-685472342c2e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-19T02:00:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T02:00:23+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine OpManager OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36923", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36923"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 2, "product": "ManageEngine OpManager OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "20188b2e-298d-4d18-a0c7-1bcfa957e8d6", "vulnerability": {"vulnId": "CVE-2023-6329", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "20188b2e-298d-4d18-a0c7-1bcfa957e8d6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-10T15:45:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-10T15:45:53+00:00"}, "scope": {"notes": "Affected: Control iD / Control iD iDSecure | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6329", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6329"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Control iD", "30d_avg": 5, "90d_avg": 4, "product": "Control iD iDSecure", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "035c8b59-c7a9-4c7f-9801-383fbd6b1aea", "vulnerability": {"vulnId": "CVE-2021-36888", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "035c8b59-c7a9-4c7f-9801-383fbd6b1aea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T15:34:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T15:34:16+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Image Hover Effects Ultimate plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-36888", "url": "https://www.cve.org/CVERecord?id=CVE-2021-36888"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Image Hover Effects Ultimate plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c5835896-edcf-4c87-8fbd-d1da1864ea68", "vulnerability": {"vulnId": "CVE-2018-14912", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c5835896-edcf-4c87-8fbd-d1da1864ea68", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T20:53:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:29+00:00"}, "scope": {"notes": "Affected: CGit / CGit | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-14912", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14912"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "CGit", "30d_avg": 0, "90d_avg": 1, "product": "CGit", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3e941c18-3842-4f6d-9f19-4a6e2dbc6c05", "vulnerability": {"vulnId": "CVE-2022-45933", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3e941c18-3842-4f6d-9f19-4a6e2dbc6c05", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:40+00:00"}, "scope": {"notes": "Affected: benc-uk / KubeView | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-45933", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45933"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "benc-uk", "30d_avg": 0, "90d_avg": 2, "product": "KubeView", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6d6c1916-bde4-4880-9d10-f9bf04ab730c", "vulnerability": {"vulnId": "CVE-2021-21389", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6d6c1916-bde4-4880-9d10-f9bf04ab730c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: Wordpress / BuddyPress plugin | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21389", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21389"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "BuddyPress plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "d0766c07-b71c-4ca9-b435-a0a84b5ae68d", "vulnerability": {"vulnId": "CVE-2022-1020", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d0766c07-b71c-4ca9-b435-a0a84b5ae68d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:23:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:23:41+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Product Table for WooCommerce (wooproducttable) plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1020", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1020"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Product Table for WooCommerce (wooproducttable) plugin", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7b9d2e33-01ab-49b1-b90a-d771f8f121ee", "vulnerability": {"vulnId": "CVE-2025-64095", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7b9d2e33-01ab-49b1-b90a-d771f8f121ee", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-23T14:33:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-02-23T14:33:28+00:00"}, "scope": {"notes": "Affected: DNN Corp / DNN (DotNetNuke) | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-64095", "url": "https://www.cve.org/CVERecord?id=CVE-2025-64095"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "DNN Corp", "30d_avg": 0, "90d_avg": 1, "product": "DNN (DotNetNuke)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b76e26d2-8f68-489c-8186-88b07a9719c4", "vulnerability": {"vulnId": "CVE-2023-25135", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b76e26d2-8f68-489c-8186-88b07a9719c4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:44+00:00"}, "scope": {"notes": "Affected: vBulletin / vBulletin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-25135", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25135"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "vBulletin", "30d_avg": 1, "90d_avg": 2, "product": "vBulletin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "04616de9-90a7-4abb-af72-9025e373e72e", "vulnerability": {"vulnId": "CVE-2023-39796", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "04616de9-90a7-4abb-af72-9025e373e72e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-19T18:15:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-19T18:15:25+00:00"}, "scope": {"notes": "Affected: WBCE / WBCE CMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-39796", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39796"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "WBCE", "30d_avg": 1, "90d_avg": 2, "product": "WBCE CMS", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7529cd0d-6b47-4d48-871e-5bfae9d098bd", "vulnerability": {"vulnId": "CVE-2019-13101", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7529cd0d-6b47-4d48-871e-5bfae9d098bd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-19T10:05:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-19T10:05:49+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-600M | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-13101", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13101"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 2, "90d_avg": 4, "product": "D-Link DIR-600M", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "da3814dc-059f-4597-aa7c-72a75a8c080c", "vulnerability": {"vulnId": "CVE-2025-57819", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "da3814dc-059f-4597-aa7c-72a75a8c080c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-17T13:49:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-17T13:49:22+00:00"}, "scope": {"notes": "Affected: FreePBX / FreePBX | Class: ip-pbx | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-57819", "url": "https://www.cve.org/CVERecord?id=CVE-2025-57819"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "FreePBX", "30d_avg": 0, "90d_avg": 1, "product": "FreePBX", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7de08f5b-3518-40ec-b2d8-ad3533ede880", "vulnerability": {"vulnId": "CVE-2020-35580", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7de08f5b-3518-40ec-b2d8-ad3533ede880", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: SearchBlox / SearchBlox | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35580", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35580"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SearchBlox", "30d_avg": 0, "90d_avg": 1, "product": "SearchBlox", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "d6933dc8-b3a7-4bdc-8382-d3378299deb0", "vulnerability": {"vulnId": "CVE-2021-20617", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d6933dc8-b3a7-4bdc-8382-d3378299deb0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T09:00:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T09:00:48+00:00"}, "scope": {"notes": "Affected: acmailer / acmailer | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20617", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20617"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "acmailer", "30d_avg": 1, "90d_avg": 2, "product": "acmailer", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "42990d60-f5e0-4bc4-9f7b-668b23cacc4f", "vulnerability": {"vulnId": "CVE-2021-3223", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "42990d60-f5e0-4bc4-9f7b-668b23cacc4f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:58+00:00"}, "scope": {"notes": "Affected: Node-RED / Node-RED-Dashboard | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3223", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3223"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Node-RED", "30d_avg": 5, "90d_avg": 4, "product": "Node-RED-Dashboard", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3f1b4e7c-fca1-45df-97a3-2360cb2f11e2", "vulnerability": {"vulnId": "CVE-2024-7593", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3f1b4e7c-fca1-45df-97a3-2360cb2f11e2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-06T20:24:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-06T20:24:02+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Virtual Traffic Manager (vTM) | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7593", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7593"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 4, "product": "Ivanti Virtual Traffic Manager (vTM)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fbb1d8fb-664f-4b3e-859d-d6d170445360", "vulnerability": {"vulnId": "CVE-2023-1020", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fbb1d8fb-664f-4b3e-859d-d6d170445360", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:42+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Steveas WP Live Chat Shoutbox plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1020", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1020"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Steveas WP Live Chat Shoutbox plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1fd8bf81-0c57-4aa1-a2e4-9bb15e8ee1d7", "vulnerability": {"vulnId": "CVE-2024-39914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fd8bf81-0c57-4aa1-a2e4-9bb15e8ee1d7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T06:27:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:27+00:00"}, "scope": {"notes": "Affected: FOG Project / FOG | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-39914", "url": "https://www.cve.org/CVERecord?id=CVE-2024-39914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "FOG Project", "30d_avg": 1, "90d_avg": 2, "product": "FOG", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fe01a997-e2ab-4e36-b043-b2b1e7b01f78", "vulnerability": {"vulnId": "CVE-2020-11854", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fe01a997-e2ab-4e36-b043-b2b1e7b01f78", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-23T19:02:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T19:02:47+00:00"}, "scope": {"notes": "Affected: Micro Focus / Operation Bridge Manager UCMDB | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11854", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11854"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Micro Focus", "30d_avg": 0, "90d_avg": 0, "product": "Operation Bridge Manager UCMDB", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7b19a304-5f96-422d-b867-c759be742707", "vulnerability": {"vulnId": "CVE-2024-9463", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7b19a304-5f96-422d-b867-c759be742707", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-10-15T07:12:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-10-15T07:12:31+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / Palo Alto Expedition | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9463", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9463"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Palo Alto Networks", "30d_avg": 0, "90d_avg": 2, "product": "Palo Alto Expedition", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "93a0304a-8f4a-46b9-a7c6-509b64d2adc2", "vulnerability": {"vulnId": "CVE-2022-3980", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "93a0304a-8f4a-46b9-a7c6-509b64d2adc2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:38+00:00"}, "scope": {"notes": "Affected: Sophos / Sophos Mobile | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-3980", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3980"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Sophos", "30d_avg": 0, "90d_avg": 2, "product": "Sophos Mobile", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1e931f5e-a071-4efd-9827-859509d00db0", "vulnerability": {"vulnId": "CVE-2024-27198", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1e931f5e-a071-4efd-9827-859509d00db0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-03-05T10:57:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-05T10:57:53+00:00"}, "scope": {"notes": "Affected: JetBrains / TeamCity | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2201", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27198", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27198"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "18", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "JetBrains", "30d_avg": 2, "90d_avg": 17, "product": "TeamCity", "cisa_kev": "yes", "connections": 2201, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "891b429d-1947-441e-abe6-fbb79a094883", "vulnerability": {"vulnId": "CVE-2024-32736", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "891b429d-1947-441e-abe6-fbb79a094883", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-22T16:42:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:42:58+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32736", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32736"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CyberPanel", "30d_avg": 0, "90d_avg": 1, "product": "CyberPanel", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "233a5455-d27d-497a-9ada-7bfe6f0cd8af", "vulnerability": {"vulnId": "CVE-2022-31656", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "233a5455-d27d-497a-9ada-7bfe6f0cd8af", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:31+00:00"}, "scope": {"notes": "Affected: VMware / Workspace ONE Access, Identity Manager and vRealize Automation | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31656", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31656"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VMware", "30d_avg": 0, "90d_avg": 1, "product": "Workspace ONE Access, Identity Manager and vRealize Automation", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bf8b34f8-0f74-44bc-8e85-91f778fef0b2", "vulnerability": {"vulnId": "CVE-2022-41412", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bf8b34f8-0f74-44bc-8e85-91f778fef0b2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2025-03-17T07:46:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-17T07:46:52+00:00"}, "scope": {"notes": "Affected: perfSONAR / perfSONAR | Class: network-monitoring | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-41412", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41412"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "perfSONAR", "30d_avg": 0, "90d_avg": 1, "product": "perfSONAR", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "0f2bd39b-ed2d-4ede-8716-945a835f6912", "vulnerability": {"vulnId": "CVE-2025-8868", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f2bd39b-ed2d-4ede-8716-945a835f6912", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-11-14T03:31:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-14T03:31:47+00:00"}, "scope": {"notes": "Affected: Progress / Chef Automate | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-8868", "url": "https://www.cve.org/CVERecord?id=CVE-2025-8868"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 2, "product": "Chef Automate", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "78ad6bce-bef1-4ebe-8183-c9e0020b8234", "vulnerability": {"vulnId": "CVE-2021-24442", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "78ad6bce-bef1-4ebe-8183-c9e0020b8234", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-06T20:33:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-06T20:33:15+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Poll, Survey, Questionnaire and Voting system plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24442", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24442"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Poll, Survey, Questionnaire and Voting system plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9b6d445b-79fa-4275-afa5-d68d896f2e45", "vulnerability": {"vulnId": "CVE-2025-34027", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9b6d445b-79fa-4275-afa5-d68d896f2e45", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-21T20:43:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-21T20:43:09+00:00"}, "scope": {"notes": "Affected: Versa / Versa Concerto | Class: device-management-platform | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34027", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34027"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Versa", "30d_avg": 0, "90d_avg": 1, "product": "Versa Concerto", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "5a4ed972-7869-405b-bb5a-d57d62f501d0", "vulnerability": {"vulnId": "CVE-2023-6875", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5a4ed972-7869-405b-bb5a-d57d62f501d0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-18T17:48:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T17:48:11+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress POST SMTP Mailer plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6875", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6875"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress POST SMTP Mailer plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c7483cdf-787f-4501-aaf5-b8c70fb78563", "vulnerability": {"vulnId": "CVE-2021-24762", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c7483cdf-787f-4501-aaf5-b8c70fb78563", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-27T04:52:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-27T04:52:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Perfect Survey plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24762", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24762"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Perfect Survey plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2c111d36-9f60-4dbf-863b-2308f9998f4d", "vulnerability": {"vulnId": "CVE-2026-41176", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2c111d36-9f60-4dbf-863b-2308f9998f4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:00:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-13T13:00:00+00:00"}, "scope": {"notes": "Affected: Rclone / Rclone | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-41176", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41176"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rclone", "30d_avg": 3, "90d_avg": 3, "product": "Rclone", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "13fbfc69-8abc-4962-8448-771be8bbb010", "vulnerability": {"vulnId": "CVE-2020-17518", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "13fbfc69-8abc-4962-8448-771be8bbb010", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-15T01:09:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T01:09:26+00:00"}, "scope": {"notes": "Affected: Apache / Flink | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17518", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17518"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 5, "90d_avg": 4, "product": "Flink", "cisa_kev": "no", "connections": 33, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "80da835f-5dd6-4e61-980f-a66cbf45d24d", "vulnerability": {"vulnId": "CVE-2022-29464", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "80da835f-5dd6-4e61-980f-a66cbf45d24d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:30+00:00"}, "scope": {"notes": "Affected: WSO2 / WSO2 multiple products | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29464", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29464"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "WSO2", "30d_avg": 1, "90d_avg": 2, "product": "WSO2 multiple products", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "74349675-59e3-46bf-820a-4f4ae7ddf3e9", "vulnerability": {"vulnId": "CVE-2021-30497", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "74349675-59e3-46bf-820a-4f4ae7ddf3e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-31T06:20:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-31T06:20:31+00:00"}, "scope": {"notes": "Affected: Ivanti / Avalanche | Class: mobile-device-management | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-30497", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30497"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 2, "product": "Avalanche", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3fb0a9a2-22ce-4694-bc38-8319c6a866b6", "vulnerability": {"vulnId": "CVE-2024-8856", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3fb0a9a2-22ce-4694-bc38-8319c6a866b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-21T10:21:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-21T10:21:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Backup and Staging by WP Time Capsule plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8856", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8856"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 3, "product": "Wordpress Backup and Staging by WP Time Capsule plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c4d6a900-ce35-4799-8472-2b0c1d612dc0", "vulnerability": {"vulnId": "CVE-2023-28343", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c4d6a900-ce35-4799-8472-2b0c1d612dc0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:47+00:00"}, "scope": {"notes": "Affected: APsystems / Altenergy Power Control Software | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-28343", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28343"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "APsystems", "30d_avg": 0, "90d_avg": 2, "product": "Altenergy Power Control Software", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eeadbb46-5304-4f80-a390-0095666e628e", "vulnerability": {"vulnId": "CVE-2020-13942", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eeadbb46-5304-4f80-a390-0095666e628e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:43:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:43:59+00:00"}, "scope": {"notes": "Affected: Apache / Unomi | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 41", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13942", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13942"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 3, "product": "Unomi", "cisa_kev": "no", "connections": 41, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6460b7c3-0b62-4eef-a243-5a2e12100650", "vulnerability": {"vulnId": "CVE-2025-4123", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6460b7c3-0b62-4eef-a243-5a2e12100650", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 76}, "timestamps": {"asserted_at": "2025-07-21T20:43:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-21T20:43:06+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: High (CVSS 7.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4123", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4123"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 1, "vendor": "Grafana", "30d_avg": 0, "90d_avg": 1, "product": "Grafana", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.6, "vulnerability_severity": "High"}}]}
{"uuid": "5ad7dd75-2291-4105-9fb3-56ab0b5fec81", "vulnerability": {"vulnId": "CVE-2021-31755", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5ad7dd75-2291-4105-9fb3-56ab0b5fec81", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:58+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda AC11 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-31755", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31755"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Tenda", "30d_avg": 3, "90d_avg": 3, "product": "Tenda AC11", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "02182180-b40c-46d9-b762-61f55d62c86b", "vulnerability": {"vulnId": "CVE-2018-1217", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "02182180-b40c-46d9-b762-61f55d62c86b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-11T14:58:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-11T14:58:19+00:00"}, "scope": {"notes": "Affected: Dell / Dell EMC Avamar Server and Dell EMC Integrated Data Protection Appliance | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 23", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-1217", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1217"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Dell", "30d_avg": 4, "90d_avg": 4, "product": "Dell EMC Avamar Server and Dell EMC Integrated Data Protection Appliance", "cisa_kev": "no", "connections": 23, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5047fffd-ffd7-4fae-93e3-986c48bf4330", "vulnerability": {"vulnId": "CVE-2022-23961", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5047fffd-ffd7-4fae-93e3-986c48bf4330", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-18T22:53:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-18T22:53:21+00:00"}, "scope": {"notes": "Affected: Thruk / Thruk | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-23961", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23961"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Thruk", "30d_avg": 1, "90d_avg": 0, "product": "Thruk", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6b2cd441-ed76-457d-a218-05e81b6c021b", "vulnerability": {"vulnId": "CVE-2023-22515", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b2cd441-ed76-457d-a218-05e81b6c021b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:00:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:02+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22515", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22515"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "Atlassian", "30d_avg": 7, "90d_avg": 12, "product": "Confluence", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ccf93e1-11e4-4d20-8e4c-ac7432f2c3b1", "vulnerability": {"vulnId": "CVE-2025-67303", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ccf93e1-11e4-4d20-8e4c-ac7432f2c3b1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:51:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-16T15:51:35+00:00"}, "scope": {"notes": "Affected: Comfy Org / ComfyUI-Manager | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-67303", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67303"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Comfy Org", "30d_avg": 4, "90d_avg": 4, "product": "ComfyUI-Manager", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "503042c4-c598-4c3e-8db9-be4d77918090", "vulnerability": {"vulnId": "CVE-2021-36380", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "503042c4-c598-4c3e-8db9-be4d77918090", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:31:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:31:22+00:00"}, "scope": {"notes": "Affected: Sunhillo / Sureline | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-36380", "url": "https://www.cve.org/CVERecord?id=CVE-2021-36380"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Sunhillo", "30d_avg": 3, "90d_avg": 3, "product": "Sureline", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1919fcce-75a3-4063-9048-1f3b6a66c19b", "vulnerability": {"vulnId": "CVE-2025-5287", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1919fcce-75a3-4063-9048-1f3b6a66c19b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-17T05:19:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-17T05:19:09+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Likes and Dislikes plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-5287", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5287"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Likes and Dislikes plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "4f3b9cfd-a409-4463-b0bd-50297305a42f", "vulnerability": {"vulnId": "CVE-2021-3708", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4f3b9cfd-a409-4463-b0bd-50297305a42f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 55}, "timestamps": {"asserted_at": "2023-10-20T03:23:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-20T03:23:18+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2750U | Class: router | Severity: Medium (CVSS 5.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3708", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3708"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DSL-2750U", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "eaa3b0a6-4767-4fca-b0ab-ceb6763eddcd", "vulnerability": {"vulnId": "CVE-2025-32814", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eaa3b0a6-4767-4fca-b0ab-ceb6763eddcd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-14T16:01:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-14T16:01:41+00:00"}, "scope": {"notes": "Affected: Infoblox / Infoblox NETMRI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-32814", "url": "https://www.cve.org/CVERecord?id=CVE-2025-32814"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Infoblox", "30d_avg": 0, "90d_avg": 1, "product": "Infoblox NETMRI", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b7523431-4193-49db-b6ec-45d25ec71611", "vulnerability": {"vulnId": "CVE-2023-27482", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b7523431-4193-49db-b6ec-45d25ec71611", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T04:05:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T04:05:25+00:00"}, "scope": {"notes": "Affected: Home Assistant / Home Assistance (Supervisor) | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27482", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27482"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 4, "vendor": "Home Assistant", "30d_avg": 7, "90d_avg": 5, "product": "Home Assistance (Supervisor)", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "ef8b6157-c769-4b89-ad5c-cc64a479a403", "vulnerability": {"vulnId": "CVE-2024-36111", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ef8b6157-c769-4b89-ad5c-cc64a479a403", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2024-12-03T15:59:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-03T15:59:30+00:00"}, "scope": {"notes": "Affected: FIT2CLOUD / KubePi | Class: device-management-platform | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-36111", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36111"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "FIT2CLOUD", "30d_avg": 1, "90d_avg": 2, "product": "KubePi", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "15be7836-2592-4388-a1bb-948ad3187266", "vulnerability": {"vulnId": "CVE-2021-34187", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "15be7836-2592-4388-a1bb-948ad3187266", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T21:57:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T21:57:49+00:00"}, "scope": {"notes": "Affected: Chamilo / LMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-34187", "url": "https://www.cve.org/CVERecord?id=CVE-2021-34187"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Chamilo", "30d_avg": 0, "90d_avg": 0, "product": "LMS", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "06e6a267-701c-4b0f-9e56-213b7fa2b49c", "vulnerability": {"vulnId": "CVE-2024-23692", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "06e6a267-701c-4b0f-9e56-213b7fa2b49c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-11-13T22:23:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-13T22:23:05+00:00"}, "scope": {"notes": "Affected: Rejetto / Rejetto HTTP File Server | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-23692", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23692"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Rejetto", "30d_avg": 0, "90d_avg": 2, "product": "Rejetto HTTP File Server", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "678b5048-1cc6-4c32-89f5-b63726d627b3", "vulnerability": {"vulnId": "CVE-2021-25646", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "678b5048-1cc6-4c32-89f5-b63726d627b3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:53+00:00"}, "scope": {"notes": "Affected: Apache / Druid | Class: database | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 66", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-25646", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25646"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 3, "vendor": "Apache", "30d_avg": 2, "90d_avg": 4, "product": "Druid", "cisa_kev": "no", "connections": 66, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "1dd34c2c-5cd5-453b-9a3c-7b7ce9f2cd9c", "vulnerability": {"vulnId": "CVE-2019-9978", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1dd34c2c-5cd5-453b-9a3c-7b7ce9f2cd9c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-19T08:22:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T08:22:38+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Social Warfare plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9978", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9978"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Social Warfare plugin", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "71d86e8b-d98d-40dd-9353-bd5959cb0d34", "vulnerability": {"vulnId": "CVE-2018-8006", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "71d86e8b-d98d-40dd-9353-bd5959cb0d34", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-20T00:48:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-20T00:48:54+00:00"}, "scope": {"notes": "Affected: Apache / ActiveMQ | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-8006", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8006"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "ActiveMQ", "cisa_kev": "no", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "9a243a2a-c97f-47f1-b814-67fcf343c50b", "vulnerability": {"vulnId": "CVE-2024-3400", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9a243a2a-c97f-47f1-b814-67fcf343c50b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-17T02:07:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-17T02:07:44+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / GlobalProtect | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-3400", "url": "https://www.cve.org/CVERecord?id=CVE-2024-3400"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Palo Alto Networks", "30d_avg": 2, "90d_avg": 1, "product": "GlobalProtect", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "48d03c0d-0658-455b-a40d-e8ea3faac4d0", "vulnerability": {"vulnId": "CVE-2023-45038", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "48d03c0d-0658-455b-a40d-e8ea3faac4d0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-08-16T05:15:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-16T05:15:47+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP Music Station | Class: nas | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-45038", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45038"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "QNAP", "30d_avg": 1, "90d_avg": 0, "product": "QNAP Music Station", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "bb50a7db-7650-4936-9da0-72a01382cb04", "vulnerability": {"vulnId": "CVE-2025-3248", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bb50a7db-7650-4936-9da0-72a01382cb04", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-05-06T00:26:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-06T00:26:41+00:00"}, "scope": {"notes": "Affected: Langflow / Langflow | Class: ai-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 62", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-3248", "url": "https://www.cve.org/CVERecord?id=CVE-2025-3248"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 2, "vendor": "Langflow", "30d_avg": 1, "90d_avg": 2, "product": "Langflow", "cisa_kev": "yes", "connections": 62, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d1b91e79-253d-4eac-a176-5c9dd3f2c1a8", "vulnerability": {"vulnId": "CVE-2025-61882", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d1b91e79-253d-4eac-a176-5c9dd3f2c1a8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-09T10:38:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-09T10:38:59+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle E-Business Suite (Oracle Concurrent Processing) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-61882", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61882"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Oracle", "30d_avg": 3, "90d_avg": 3, "product": "Oracle E-Business Suite (Oracle Concurrent Processing)", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ce546a68-4079-40d3-9198-2b220954c4d1", "vulnerability": {"vulnId": "CVE-2025-0674", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ce546a68-4079-40d3-9198-2b220954c4d1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-07-18T23:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-18T23:57:40+00:00"}, "scope": {"notes": "Affected: Elber / Elber (multiple products) | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-0674", "url": "https://www.cve.org/CVERecord?id=CVE-2025-0674"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Elber", "30d_avg": 0, "90d_avg": 2, "product": "Elber (multiple products)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "439cfc4f-8c8a-4dc1-ad4b-1af056a3f9c7", "vulnerability": {"vulnId": "CVE-2021-28149", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "439cfc4f-8c8a-4dc1-ad4b-1af056a3f9c7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-23T18:05:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T18:05:31+00:00"}, "scope": {"notes": "Affected: Hongdian / Hongdian H8922 | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-28149", "url": "https://www.cve.org/CVERecord?id=CVE-2021-28149"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Hongdian", "30d_avg": 0, "90d_avg": 0, "product": "Hongdian H8922", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "f91b9f08-0785-47eb-8fc1-f6a6d214b79b", "vulnerability": {"vulnId": "CVE-2025-4322", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f91b9f08-0785-47eb-8fc1-f6a6d214b79b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-29T01:13:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-29T01:13:46+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Motors theme | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4322", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4322"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 1, "product": "Wordpress Motors theme", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "13742627-92cd-436d-822c-b64a8fd35615", "vulnerability": {"vulnId": "CVE-2024-48455", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "13742627-92cd-436d-822c-b64a8fd35615", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 27}, "timestamps": {"asserted_at": "2025-02-04T21:15:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-04T21:15:52+00:00"}, "scope": {"notes": "Affected: Netis / Netis routers multiple models | Class: router | Severity: Low (CVSS 2.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-48455", "url": "https://www.cve.org/CVERecord?id=CVE-2024-48455"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Netis", "30d_avg": 2, "90d_avg": 3, "product": "Netis routers multiple models", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 2.7, "vulnerability_severity": "Low"}}]}
{"uuid": "cc0ce440-9efa-4ea0-9e3e-d94c55c2c941", "vulnerability": {"vulnId": "CVE-2025-10353", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc0ce440-9efa-4ea0-9e3e-d94c55c2c941", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-10T17:10:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T17:10:34+00:00"}, "scope": {"notes": "Affected: Melis Technology / Melis Platform | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-10353", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10353"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Melis Technology", "30d_avg": 2, "90d_avg": 2, "product": "Melis Platform", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "5497dfe4-d2a0-434b-b6fd-bb01d79b7a76", "vulnerability": {"vulnId": "CVE-2023-42793", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5497dfe4-d2a0-434b-b6fd-bb01d79b7a76", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T20:10:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T20:10:58+00:00"}, "scope": {"notes": "Affected: JetBrains / TeamCity | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1050", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-42793", "url": "https://www.cve.org/CVERecord?id=CVE-2023-42793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "JetBrains", "30d_avg": 6, "90d_avg": 14, "product": "TeamCity", "cisa_kev": "yes", "connections": 1050, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9d46fb90-1d7c-4cb5-8731-ff8853bd4fb0", "vulnerability": {"vulnId": "CVE-2026-24423", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9d46fb90-1d7c-4cb5-8731-ff8853bd4fb0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-06-08T12:19:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-06-08T12:19:21+00:00"}, "scope": {"notes": "Affected: SmarterTools / SmarterMail | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-24423", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24423"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "SmarterTools", "30d_avg": 0, "90d_avg": 0, "product": "SmarterMail", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "107a701a-ac4c-429f-9106-b123db7e4421", "vulnerability": {"vulnId": "CVE-2021-36260", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "107a701a-ac4c-429f-9106-b123db7e4421", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:01+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision Web Server | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-36260", "url": "https://www.cve.org/CVERecord?id=CVE-2021-36260"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 2, "vendor": "Hikvision", "30d_avg": 7, "90d_avg": 5, "product": "Hikvision Web Server", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b2470d89-102e-41a7-940c-37c49d2cc636", "vulnerability": {"vulnId": "CVE-2023-29357", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b2470d89-102e-41a7-940c-37c49d2cc636", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T22:53:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-18T22:53:21+00:00"}, "scope": {"notes": "Affected: Microsoft / SharePoint | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-29357", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29357"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Microsoft", "30d_avg": 1, "90d_avg": 3, "product": "SharePoint", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9f813fc5-06ca-40bc-bb53-6576a0d65770", "vulnerability": {"vulnId": "CVE-2026-34197", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9f813fc5-06ca-40bc-bb53-6576a0d65770", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-04-24T16:01:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-24T16:01:56+00:00"}, "scope": {"notes": "Affected: Apache / ActiveMQ | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-34197", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34197"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 3, "90d_avg": 3, "product": "ActiveMQ", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "c78dd561-abd8-4d80-b954-9027fd7792de", "vulnerability": {"vulnId": "CVE-2018-14558", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c78dd561-abd8-4d80-b954-9027fd7792de", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-28T08:28:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-28T08:28:44+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda AC7/AC9/AC10 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-14558", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14558"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "Tenda", "30d_avg": 2, "90d_avg": 1, "product": "Tenda AC7/AC9/AC10", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d92c7613-6e82-4d5e-a92b-799fc57656b1", "vulnerability": {"vulnId": "CVE-2020-1943", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d92c7613-6e82-4d5e-a92b-799fc57656b1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T17:42:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T17:42:25+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-1943", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1943"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "OFBiz", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "f4ab4dd9-4529-46b1-8046-8dc0d861b2ab", "vulnerability": {"vulnId": "CVE-2021-3297", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f4ab4dd9-4529-46b1-8046-8dc0d861b2ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2025-08-19T11:59:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-19T11:59:12+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NBG2105 | Class: router | Severity: High (CVSS 7.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3297", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3297"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Zyxel", "30d_avg": 1, "90d_avg": 2, "product": "Zyxel NBG2105", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "326ef5c6-3ad5-4942-9db4-0acd1d5d49c1", "vulnerability": {"vulnId": "CVE-2018-10737", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "326ef5c6-3ad5-4942-9db4-0acd1d5d49c1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-17T22:27:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-17T22:27:51+00:00"}, "scope": {"notes": "Affected: Nagios / Nagios XI | Class: other-software | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-10737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10737"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Nagios", "30d_avg": 1, "90d_avg": 2, "product": "Nagios XI", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "5f8cae92-e359-4bb5-9bfc-f55bdd8392e9", "vulnerability": {"vulnId": "CVE-2020-17519", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5f8cae92-e359-4bb5-9bfc-f55bdd8392e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Apache / Flink | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 54", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17519", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17519"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Apache", "30d_avg": 5, "90d_avg": 5, "product": "Flink", "cisa_kev": "yes", "connections": 54, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "4dcf1ca1-afb9-4630-ad30-09a12f27c516", "vulnerability": {"vulnId": "CVE-2025-34152", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4dcf1ca1-afb9-4630-ad30-09a12f27c516", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 94}, "timestamps": {"asserted_at": "2026-03-25T17:41:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-25T17:41:53+00:00"}, "scope": {"notes": "Affected: Shenzhen Aitemi / Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) | Class: router | Severity: Critical (CVSS 9.4) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34152", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34152"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Aitemi", "30d_avg": 0, "90d_avg": 1, "product": "Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.4, "vulnerability_severity": "Critical"}}]}
{"uuid": "b68d25af-5148-439e-801d-b6d948ca6bae", "vulnerability": {"vulnId": "CVE-2026-1405", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b68d25af-5148-439e-801d-b6d948ca6bae", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-06T18:37:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-06T18:37:12+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Slider Future plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1405", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1405"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Slider Future plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e3af402f-b455-433a-b766-13f3cdd9993d", "vulnerability": {"vulnId": "CVE-2025-34143", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e3af402f-b455-433a-b766-13f3cdd9993d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-08-02T18:13:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-02T18:13:38+00:00"}, "scope": {"notes": "Affected: ETQ / ETQ Reliance | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34143", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34143"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ETQ", "30d_avg": 0, "90d_avg": 1, "product": "ETQ Reliance", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "ace3a949-3d3e-4c17-ad0e-f1b4cfa3a4f2", "vulnerability": {"vulnId": "CVE-2025-24893", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ace3a949-3d3e-4c17-ad0e-f1b4cfa3a4f2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-04-20T02:43:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-04-20T02:43:13+00:00"}, "scope": {"notes": "Affected: XWiki / XWiki Platform | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-24893", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24893"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "XWiki", "30d_avg": 1, "90d_avg": 2, "product": "XWiki Platform", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "05f648da-e220-47b1-9b51-6b46568a1f03", "vulnerability": {"vulnId": "CVE-2025-34044", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "05f648da-e220-47b1-9b51-6b46568a1f03", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-29T16:41:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-29T16:41:59+00:00"}, "scope": {"notes": "Affected: Shenzhen Lingkong Technology / WIFISKY 7-layer flow control router | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34044", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34044"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Lingkong Technology", "30d_avg": 0, "90d_avg": 0, "product": "WIFISKY 7-layer flow control router", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "bd29c5bc-9dd5-4bd2-a688-daad70b0ab46", "vulnerability": {"vulnId": "CVE-2020-3580", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bd29c5bc-9dd5-4bd2-a688-daad70b0ab46", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T17:47:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T17:47:20+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ASA and Cisco Firepower Threat Defense | Class: firewall | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 56", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-3580", "url": "https://www.cve.org/CVERecord?id=CVE-2020-3580"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 0, "product": "Cisco ASA and Cisco Firepower Threat Defense", "cisa_kev": "yes", "connections": 56, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "fb536477-40a4-4284-871b-d235ddc94b20", "vulnerability": {"vulnId": "CVE-2023-47218", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fb536477-40a4-4284-871b-d235ddc94b20", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-16T05:56:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-16T05:56:10+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS and QuTS Hero | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-47218", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47218"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP QTS and QuTS Hero", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "03361575-6eaf-450f-821c-1607be71ef94", "vulnerability": {"vulnId": "CVE-2025-44177", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "03361575-6eaf-450f-821c-1607be71ef94", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2025-08-12T19:13:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-12T19:13:32+00:00"}, "scope": {"notes": "Affected: White Star Software / White Star Software Potop | Class: network-monitoring | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-44177", "url": "https://www.cve.org/CVERecord?id=CVE-2025-44177"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "White Star Software", "30d_avg": 0, "90d_avg": 1, "product": "White Star Software Potop", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "2ade6c5b-1f6d-4406-921e-9d673207b20d", "vulnerability": {"vulnId": "CVE-2025-34045", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2ade6c5b-1f6d-4406-921e-9d673207b20d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-18T08:20:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T08:20:47+00:00"}, "scope": {"notes": "Affected: WeiPHP / WeiPHP | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34045", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34045"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "WeiPHP", "30d_avg": 4, "90d_avg": 4, "product": "WeiPHP", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "1a581b3a-8460-4d4c-93ce-db446e30051b", "vulnerability": {"vulnId": "CVE-2026-21858", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1a581b3a-8460-4d4c-93ce-db446e30051b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-01-27T23:40:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-27T23:40:56+00:00"}, "scope": {"notes": "Affected: n8n / n8n | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 108", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-21858", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21858"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "n8n", "30d_avg": 0, "90d_avg": 0, "product": "n8n", "cisa_kev": "no", "connections": 108, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "63c1260d-4aa2-41cd-8fcb-ce9ddeaebabe", "vulnerability": {"vulnId": "CVE-2020-36870", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "63c1260d-4aa2-41cd-8fcb-ce9ddeaebabe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:56:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:56:29+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / NBR | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-36870", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36870"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Ruijie Networks", "30d_avg": 2, "90d_avg": 1, "product": "NBR", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "72770201-010d-4ffb-801c-48a7ed30e91a", "vulnerability": {"vulnId": "CVE-2023-24488", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "72770201-010d-4ffb-801c-48a7ed30e91a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-17T08:13:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-17T08:13:43+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ADC and Citrix Gateway | Class: app-delivery-controller | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-24488", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24488"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 7, "90d_avg": 20, "product": "Citrix ADC and Citrix Gateway", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "312f025f-6823-4cdf-8c67-6d3c10e95ab3", "vulnerability": {"vulnId": "CVE-2025-5086", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "312f025f-6823-4cdf-8c67-6d3c10e95ab3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 90}, "timestamps": {"asserted_at": "2025-07-31T15:09:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-31T15:09:20+00:00"}, "scope": {"notes": "Affected: Dassualt Systems / DELMIA Apriso | Class: other-software | Severity: Critical (CVSS 9) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-5086", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5086"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Dassualt Systems", "30d_avg": 0, "90d_avg": 2, "product": "DELMIA Apriso", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9, "vulnerability_severity": "Critical"}}]}
{"uuid": "a7b9adda-549c-44c0-b67d-444ecd1affc4", "vulnerability": {"vulnId": "CVE-2025-34509", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a7b9adda-549c-44c0-b67d-444ecd1affc4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-11-14T03:30:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-14T03:30:32+00:00"}, "scope": {"notes": "Affected: Sitecore / Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC) | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34509", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34509"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Sitecore", "30d_avg": 0, "90d_avg": 1, "product": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1910d904-1f5b-49be-af7d-e391c52b93a6", "vulnerability": {"vulnId": "CVE-2023-47246", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1910d904-1f5b-49be-af7d-e391c52b93a6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-01T07:54:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-01T07:54:55+00:00"}, "scope": {"notes": "Affected: SysAid / SysAid On-Premise | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-47246", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47246"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "SysAid", "30d_avg": 5, "90d_avg": 4, "product": "SysAid On-Premise", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "795fb45f-3cef-40c4-88a7-27cfab4e027e", "vulnerability": {"vulnId": "CVE-2024-21620", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "795fb45f-3cef-40c4-88a7-27cfab4e027e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2025-08-24T05:14:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-24T05:14:38+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS (J-Web) | Class: router | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21620", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21620"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Juniper", "30d_avg": 0, "90d_avg": 8, "product": "Junos OS (J-Web)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "02400453-dff1-43c6-96c0-5d0eb4aaefcd", "vulnerability": {"vulnId": "CVE-2025-47539", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "02400453-dff1-43c6-96c0-5d0eb4aaefcd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T19:04:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-13T19:04:47+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Themewinter Eventin plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-47539", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47539"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Themewinter Eventin plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6192a8f9-52c4-4831-9678-b685ad396175", "vulnerability": {"vulnId": "CVE-2018-16059", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6192a8f9-52c4-4831-9678-b685ad396175", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-19T18:02:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T18:02:19+00:00"}, "scope": {"notes": "Affected: Endress+Hauser / WirelessHART Fieldgate SWG70 | Class: router | Severity: Medium (CVSS 5.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-16059", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Endress+Hauser", "30d_avg": 1, "90d_avg": 0, "product": "WirelessHART Fieldgate SWG70", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "5f982250-9141-4ca0-a3e2-be5015c2e130", "vulnerability": {"vulnId": "CVE-2019-2588", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5f982250-9141-4ca0-a3e2-be5015c2e130", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 49}, "timestamps": {"asserted_at": "2023-10-23T11:01:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T11:01:11+00:00"}, "scope": {"notes": "Affected: Oracle / BI Publisher (Oracle Fusion Middleware) | Class: other-software | Severity: Medium (CVSS 4.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-2588", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2588"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "BI Publisher (Oracle Fusion Middleware)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 4.9, "vulnerability_severity": "Medium"}}]}
{"uuid": "fd0d632a-6d1c-4ce3-b313-b165c927ec17", "vulnerability": {"vulnId": "CVE-2025-15503", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fd0d632a-6d1c-4ce3-b313-b165c927ec17", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T17:11:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T17:11:06+00:00"}, "scope": {"notes": "Affected: Sangfor / Sangfor Operation and Maintenance Management System | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-15503", "url": "https://www.cve.org/CVERecord?id=CVE-2025-15503"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Sangfor", "30d_avg": 2, "90d_avg": 1, "product": "Sangfor Operation and Maintenance Management System", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0f2f5ac1-72e6-4757-880f-d0b3a4fcfd09", "vulnerability": {"vulnId": "CVE-2021-21972", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f2f5ac1-72e6-4757-880f-d0b3a4fcfd09", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-17T22:28:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-17T22:28:30+00:00"}, "scope": {"notes": "Affected: VMWare / vCenter Server | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21972", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21972"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VMWare", "30d_avg": 0, "90d_avg": 0, "product": "vCenter Server", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a0453ab0-eb34-4777-95e0-ad56fa32b9b9", "vulnerability": {"vulnId": "CVE-2021-28150", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a0453ab0-eb34-4777-95e0-ad56fa32b9b9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 55}, "timestamps": {"asserted_at": "2025-08-23T19:46:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-23T19:46:44+00:00"}, "scope": {"notes": "Affected: Hongdian / Hongdian H8922 | Class: router | Severity: Medium (CVSS 5.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-28150", "url": "https://www.cve.org/CVERecord?id=CVE-2021-28150"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Hongdian", "30d_avg": 0, "90d_avg": 0, "product": "Hongdian H8922", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "bcb0b0c3-bb21-4920-b584-9e9bf0e87e75", "vulnerability": {"vulnId": "CVE-2019-18818", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bcb0b0c3-bb21-4920-b584-9e9bf0e87e75", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:09+00:00"}, "scope": {"notes": "Affected: strapi / strapi | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18818", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18818"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "strapi", "30d_avg": 1, "90d_avg": 2, "product": "strapi", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "25dfd85a-a721-4ab3-a6c6-ec9f2d159862", "vulnerability": {"vulnId": "CVE-2021-20028", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "25dfd85a-a721-4ab3-a6c6-ec9f2d159862", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-16T08:44:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-16T08:44:02+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicWall Secure Remote Access | Class: vpn | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20028", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20028"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 1, "vendor": "SonicWall", "30d_avg": 1, "90d_avg": 2, "product": "SonicWall Secure Remote Access", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f20495ea-1e61-4442-a94f-8d7e9be41b42", "vulnerability": {"vulnId": "CVE-2022-41082", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f20495ea-1e61-4442-a94f-8d7e9be41b42", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-13T22:10:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T22:10:59+00:00"}, "scope": {"notes": "Affected: Microsoft / Exchange | Class: email | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 134", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-41082", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41082"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "124", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 214, "vendor": "Microsoft", "30d_avg": 195, "90d_avg": 170, "product": "Exchange", "cisa_kev": "yes", "connections": 134, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "4b569516-6dd3-4ed5-a91d-97ef4b12027a", "vulnerability": {"vulnId": "CVE-2025-34028", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4b569516-6dd3-4ed5-a91d-97ef4b12027a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-04-30T07:57:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-04-30T07:57:57+00:00"}, "scope": {"notes": "Affected: Commvault / Commvault Command Center | Class: backup | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34028", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34028"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "backup", "7d_avg": 0, "vendor": "Commvault", "30d_avg": 0, "90d_avg": 1, "product": "Commvault Command Center", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "dabb8297-dc95-442f-8e45-596fe7709811", "vulnerability": {"vulnId": "CVE-2020-36112", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dabb8297-dc95-442f-8e45-596fe7709811", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: CSE Bookstore / CSE Bookstore | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-36112", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36112"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "CSE Bookstore", "30d_avg": 1, "90d_avg": 2, "product": "CSE Bookstore", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1b3032aa-e679-459e-8079-242c80bb508b", "vulnerability": {"vulnId": "CVE-2018-19410", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b3032aa-e679-459e-8079-242c80bb508b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-11-26T03:19:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-26T03:19:00+00:00"}, "scope": {"notes": "Affected: Paessler / PRTG Network Monitor | Class: network-monitoring | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 26", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-19410", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19410"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 1, "vendor": "Paessler", "30d_avg": 1, "90d_avg": 2, "product": "PRTG Network Monitor", "cisa_kev": "yes", "connections": 26, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "9aa807b1-a8ce-4eac-b8cc-0b1cd1dcdb83", "vulnerability": {"vulnId": "CVE-2018-10942", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9aa807b1-a8ce-4eac-b8cc-0b1cd1dcdb83", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-28T00:01:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-28T00:01:52+00:00"}, "scope": {"notes": "Affected: PrestaShop / Attribute Wizard addon for PrestaShop | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-10942", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10942"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "PrestaShop", "30d_avg": 5, "90d_avg": 3, "product": "Attribute Wizard addon for PrestaShop", "cisa_kev": "no", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "27b50ea1-f39a-4f9a-9e1a-597e6baddd92", "vulnerability": {"vulnId": "CVE-2025-49493", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "27b50ea1-f39a-4f9a-9e1a-597e6baddd92", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 58}, "timestamps": {"asserted_at": "2025-07-31T15:09:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-31T15:09:08+00:00"}, "scope": {"notes": "Affected: Akamai / Akamai CloudTest | Class: other-software | Severity: Medium (CVSS 5.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-49493", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49493"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Akamai", "30d_avg": 0, "90d_avg": 1, "product": "Akamai CloudTest", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.8, "vulnerability_severity": "Medium"}}]}
{"uuid": "1fb8e40c-4cf9-46b9-9562-25c94495243e", "vulnerability": {"vulnId": "CVE-2025-4009", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fb8e40c-4cf9-46b9-9562-25c94495243e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-13T19:04:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-13T19:04:55+00:00"}, "scope": {"notes": "Affected: Evertz / Evertz SDVN 3080ipx-10G and others | Class: router | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4009", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4009"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Evertz", "30d_avg": 0, "90d_avg": 1, "product": "Evertz SDVN 3080ipx-10G and others", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "3b9cc265-b7b0-4fd4-81bb-d0d894b681ce", "vulnerability": {"vulnId": "CVE-2017-15944", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3b9cc265-b7b0-4fd4-81bb-d0d894b681ce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:18:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:18:28+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / PAN-OS | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-15944", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15944"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "Palo Alto Networks", "30d_avg": 2, "90d_avg": 2, "product": "PAN-OS", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c68eec12-1f72-4edd-aca9-76e50e387f13", "vulnerability": {"vulnId": "CVE-2014-2321", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c68eec12-1f72-4edd-aca9-76e50e387f13", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T06:22:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T06:22:32+00:00"}, "scope": {"notes": "Affected: ZTE / ZTE F460,F660 | Class: router | Severity: High (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-2321", "url": "https://www.cve.org/CVERecord?id=CVE-2014-2321"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ZTE", "30d_avg": 0, "90d_avg": 0, "product": "ZTE F460,F660", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "High"}}]}
{"uuid": "fc98f0df-0ee0-4613-89ea-45a9328c57b0", "vulnerability": {"vulnId": "CVE-2018-15961", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fc98f0df-0ee0-4613-89ea-45a9328c57b0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:42:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:42:04+00:00"}, "scope": {"notes": "Affected: Apache / ColdFusion | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 23", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-15961", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15961"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "Apache", "30d_avg": 5, "90d_avg": 3, "product": "ColdFusion", "cisa_kev": "yes", "connections": 23, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "31b9ca7d-6758-49c6-a7c0-5b7f11835d13", "vulnerability": {"vulnId": "CVE-2024-46938", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "31b9ca7d-6758-49c6-a7c0-5b7f11835d13", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-20T12:17:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-20T12:17:12+00:00"}, "scope": {"notes": "Affected: Sitecore / Sitecore Experience Manager (XM), Experience Platform (XP), Experience | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-46938", "url": "https://www.cve.org/CVERecord?id=CVE-2024-46938"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Sitecore", "30d_avg": 0, "90d_avg": 0, "product": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "460a1b3b-654f-4e4e-bb38-cc5fbaac63ed", "vulnerability": {"vulnId": "CVE-2020-26879", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "460a1b3b-654f-4e4e-bb38-cc5fbaac63ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-11T17:59:33+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-11T17:59:33+00:00"}, "scope": {"notes": "Affected: Ruckus / Ruckus vRioT | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-26879", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26879"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Ruckus", "30d_avg": 1, "90d_avg": 2, "product": "Ruckus vRioT", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "933f6e84-f764-42f5-8c81-dabe56613226", "vulnerability": {"vulnId": "CVE-2022-31137", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "933f6e84-f764-42f5-8c81-dabe56613226", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-03T11:09:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-03T11:09:05+00:00"}, "scope": {"notes": "Affected: Roxy-WI / Roxy-WI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31137"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Roxy-WI", "30d_avg": 1, "90d_avg": 2, "product": "Roxy-WI", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0f53ae6e-4d17-4072-8210-745be58f277c", "vulnerability": {"vulnId": "CVE-2021-41649", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f53ae6e-4d17-4072-8210-745be58f277c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-10T12:51:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-10T12:51:24+00:00"}, "scope": {"notes": "Affected: PuneethReddyHC / PuneethReddyHC | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41649", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41649"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "PuneethReddyHC", "30d_avg": 1, "90d_avg": 2, "product": "PuneethReddyHC", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4493c1d8-fd43-4fd0-b92c-076ebeb203a7", "vulnerability": {"vulnId": "CVE-2024-13985", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4493c1d8-fd43-4fd0-b92c-076ebeb203a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-09-23T17:25:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-09-23T17:25:57+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua EIMS | Class: device-management-platform | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13985", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13985"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Dahua", "30d_avg": 0, "90d_avg": 0, "product": "Dahua EIMS", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a2d1f55e-f137-4162-bc9a-41dd1ebb1964", "vulnerability": {"vulnId": "CVE-2025-24799", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a2d1f55e-f137-4162-bc9a-41dd1ebb1964", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-04-17T13:56:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-04-17T13:56:12+00:00"}, "scope": {"notes": "Affected: GLPI / GLPI | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-24799", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24799"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "GLPI", "30d_avg": 0, "90d_avg": 1, "product": "GLPI", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "86b9471f-36b5-4754-b0a0-5787a3fafacc", "vulnerability": {"vulnId": "CVE-2025-29063", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "86b9471f-36b5-4754-b0a0-5787a3fafacc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-02T16:08:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-02T16:08:06+00:00"}, "scope": {"notes": "Affected: LB-LINK / LB-LINK BL-AC2100 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-29063", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29063"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "LB-LINK", "30d_avg": 0, "90d_avg": 1, "product": "LB-LINK BL-AC2100", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f33694b2-0eae-4d5b-aa1e-94c0c0b20b19", "vulnerability": {"vulnId": "CVE-2022-0592", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f33694b2-0eae-4d5b-aa1e-94c0c0b20b19", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-08T21:43:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-08T21:43:23+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress MapSVG plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0592", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0592"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress MapSVG plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "29827c56-6755-4362-a3a4-5b1dae2c11b3", "vulnerability": {"vulnId": "CVE-2024-6893", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "29827c56-6755-4362-a3a4-5b1dae2c11b3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-04T06:17:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-04T06:17:34+00:00"}, "scope": {"notes": "Affected: Journeyx / Journeyx | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6893", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6893"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Journeyx", "30d_avg": 0, "90d_avg": 2, "product": "Journeyx", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "0f48b4e7-cdf1-4ea5-892a-cee188646d54", "vulnerability": {"vulnId": "CVE-2023-2648", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f48b4e7-cdf1-4ea5-892a-cee188646d54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-07T15:46:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-07T15:46:05+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-2648", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2648"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Weaver", "30d_avg": 5, "90d_avg": 4, "product": "Weaver E-Office", "cisa_kev": "no", "connections": 13, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d330c49e-da53-44e0-9c39-da9ecbaff379", "vulnerability": {"vulnId": "CVE-2025-30406", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d330c49e-da53-44e0-9c39-da9ecbaff379", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-31T11:19:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-31T11:19:46+00:00"}, "scope": {"notes": "Affected: Gladinet / Gladinet CentreStack | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-30406", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30406"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 1, "vendor": "Gladinet", "30d_avg": 0, "90d_avg": 1, "product": "Gladinet CentreStack", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1458f9c9-2f1e-41d6-9e2a-ea9bac93a96a", "vulnerability": {"vulnId": "CVE-2021-25899", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1458f9c9-2f1e-41d6-9e2a-ea9bac93a96a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:53+00:00"}, "scope": {"notes": "Affected: Void Sistemas / Aurall REC Monitor | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-25899", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25899"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Void Sistemas", "30d_avg": 1, "90d_avg": 2, "product": "Aurall REC Monitor", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2402c0d1-cda8-46ec-af07-78c2c2b6b439", "vulnerability": {"vulnId": "CVE-2018-3810", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2402c0d1-cda8-46ec-af07-78c2c2b6b439", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:54:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:54:52+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Oturia Smart Google Code Inserter plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-3810", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3810"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 3, "product": "Wordpress Oturia Smart Google Code Inserter plugin", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a1427ffb-b5e6-446c-afba-1e1d95b07b11", "vulnerability": {"vulnId": "CVE-2020-4463", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a1427ffb-b5e6-446c-afba-1e1d95b07b11", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: IBM / Maximo Asset Management | Class: device-management-platform | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-4463", "url": "https://www.cve.org/CVERecord?id=CVE-2020-4463"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "IBM", "30d_avg": 5, "90d_avg": 4, "product": "Maximo Asset Management", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "e27a40d3-2123-4b51-98b5-1bbe46c3c7ae", "vulnerability": {"vulnId": "CVE-2024-49380", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e27a40d3-2123-4b51-98b5-1bbe46c3c7ae", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-11-29T02:00:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-29T02:00:35+00:00"}, "scope": {"notes": "Affected: plentico / plenti | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-49380", "url": "https://www.cve.org/CVERecord?id=CVE-2024-49380"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "plentico", "30d_avg": 5, "90d_avg": 4, "product": "plenti", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "f8671c3f-052a-494f-b046-cdef47bf8962", "vulnerability": {"vulnId": "CVE-2025-4210", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8671c3f-052a-494f-b046-cdef47bf8962", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-03-08T21:53:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-08T21:53:18+00:00"}, "scope": {"notes": "Affected: Casdoor / Casdoor | Class: ai-system | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4210", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4210"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "Casdoor", "30d_avg": 1, "90d_avg": 2, "product": "Casdoor", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "c7693ecb-f087-44f2-8388-8b78ced8e0f9", "vulnerability": {"vulnId": "CVE-2023-40748", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c7693ecb-f087-44f2-8388-8b78ced8e0f9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-25T19:05:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-25T19:05:45+00:00"}, "scope": {"notes": "Affected: PHPJabbers / PHPJabbers Food Delivery Script | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-40748", "url": "https://www.cve.org/CVERecord?id=CVE-2023-40748"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "PHPJabbers", "30d_avg": 1, "90d_avg": 3, "product": "PHPJabbers Food Delivery Script", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0bb976a5-2ce2-46da-b686-ce3fa3f2a5c8", "vulnerability": {"vulnId": "CVE-2020-12800", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0bb976a5-2ce2-46da-b686-ce3fa3f2a5c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:19+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Plugin drag-and-drop-multiple-file-upload-contact-form-7  | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-12800", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12800"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Plugin drag-and-drop-multiple-file-upload-contact-form-7 ", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5f92a6dc-9bbf-4ca2-a0bd-68e977f2d179", "vulnerability": {"vulnId": "CVE-2025-69200", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5f92a6dc-9bbf-4ca2-a0bd-68e977f2d179", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-01-18T14:08:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T14:08:56+00:00"}, "scope": {"notes": "Affected: phpMyFAQ / phpMyFAQ | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-69200", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69200"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "phpMyFAQ", "30d_avg": 1, "90d_avg": 2, "product": "phpMyFAQ", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a9dd0ead-f611-4fa8-8f2b-5a65a0fe8da8", "vulnerability": {"vulnId": "CVE-2021-21307", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a9dd0ead-f611-4fa8-8f2b-5a65a0fe8da8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:13+00:00"}, "scope": {"notes": "Affected: Lucee / Lucee Server | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21307", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21307"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Lucee", "30d_avg": 4, "90d_avg": 4, "product": "Lucee Server", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "72a1641d-e6da-47c7-8824-1270c153e81c", "vulnerability": {"vulnId": "CVE-2019-10758", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "72a1641d-e6da-47c7-8824-1270c153e81c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2023-10-14T14:56:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:01+00:00"}, "scope": {"notes": "Affected: mongo-express / mongo-express | Class: database | Severity: Critical (CVSS 9.9) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-10758", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10758"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "mongo-express", "30d_avg": 1, "90d_avg": 2, "product": "mongo-express", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "56a7092f-d868-4624-9d7c-91e3eb4adf75", "vulnerability": {"vulnId": "CVE-2020-17506", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "56a7092f-d868-4624-9d7c-91e3eb4adf75", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:54:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:54:04+00:00"}, "scope": {"notes": "Affected: Artica / Artica Web Proxy | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17506", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17506"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Artica", "30d_avg": 5, "90d_avg": 5, "product": "Artica Web Proxy", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c83d7218-b959-4b66-90dc-5f2ecc169c67", "vulnerability": {"vulnId": "CVE-2022-38296", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c83d7218-b959-4b66-90dc-5f2ecc169c67", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-06T23:04:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-06T23:04:04+00:00"}, "scope": {"notes": "Affected: CuppaCMS / CuppaCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-38296", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38296"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "CuppaCMS", "30d_avg": 5, "90d_avg": 4, "product": "CuppaCMS", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "46371b6a-958e-45a6-a075-66b13a6b4691", "vulnerability": {"vulnId": "CVE-2023-1698", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "46371b6a-958e-45a6-a075-66b13a6b4691", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:42+00:00"}, "scope": {"notes": "Affected: WAGO / WAGO products (multiple) | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1698", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1698"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 2, "vendor": "WAGO", "30d_avg": 1, "90d_avg": 2, "product": "WAGO products (multiple)", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b5d54e6b-1cf5-4f97-945e-2db405dcd801", "vulnerability": {"vulnId": "CVE-2023-42344", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b5d54e6b-1cf5-4f97-945e-2db405dcd801", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-04-02T17:28:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-02T17:28:55+00:00"}, "scope": {"notes": "Affected: Alkacon / OpenCms | Class: cms | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-42344", "url": "https://www.cve.org/CVERecord?id=CVE-2023-42344"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Alkacon", "30d_avg": 5, "90d_avg": 3, "product": "OpenCms", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "d821efe5-5e8f-4341-aff3-3177adf4d3f1", "vulnerability": {"vulnId": "CVE-2022-47986", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d821efe5-5e8f-4341-aff3-3177adf4d3f1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:41+00:00"}, "scope": {"notes": "Affected: IBM / Aspera Faspex | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-47986", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47986"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "IBM", "30d_avg": 0, "90d_avg": 2, "product": "Aspera Faspex", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "c38e439f-6e00-42d0-b6f0-80357b03ab2f", "vulnerability": {"vulnId": "CVE-2021-41277", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c38e439f-6e00-42d0-b6f0-80357b03ab2f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:14+00:00"}, "scope": {"notes": "Affected: Metabase / Metabase | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 31", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41277", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41277"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Metabase", "30d_avg": 6, "90d_avg": 4, "product": "Metabase", "cisa_kev": "yes", "connections": 31, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "07842e84-0503-4c6b-bd1a-c1119d4e3b7c", "vulnerability": {"vulnId": "CVE-2023-46347", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "07842e84-0503-4c6b-bd1a-c1119d4e3b7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-19T18:19:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-19T18:19:01+00:00"}, "scope": {"notes": "Affected: PrestaShop / NDK Design for PrestaShop | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-46347", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46347"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "PrestaShop", "30d_avg": 1, "90d_avg": 2, "product": "NDK Design for PrestaShop", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3e17b33f-831e-4f2b-8aaf-462f576e4e06", "vulnerability": {"vulnId": "CVE-2022-0846", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3e17b33f-831e-4f2b-8aaf-462f576e4e06", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:17:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:17:29+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress SpeakOut! Email Petitions plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0846", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0846"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress SpeakOut! Email Petitions plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d748dab2-c7a2-4d57-b8e0-7bd6fe9e1701", "vulnerability": {"vulnId": "CVE-2023-51409", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d748dab2-c7a2-4d57-b8e0-7bd6fe9e1701", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-05T12:11:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-05T12:11:14+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Jordy Meow AI Engine: ChatGPT Chatbot plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-51409", "url": "https://www.cve.org/CVERecord?id=CVE-2023-51409"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Jordy Meow AI Engine: ChatGPT Chatbot plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f7b0e71d-c037-4e74-98e7-99ef9a8c7cb0", "vulnerability": {"vulnId": "CVE-2016-0457", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f7b0e71d-c037-4e74-98e7-99ef9a8c7cb0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 50}, "timestamps": {"asserted_at": "2023-10-19T22:53:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T22:53:14+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle E-Business Suite | Class: other-software | Severity: Medium (CVSS 5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-0457", "url": "https://www.cve.org/CVERecord?id=CVE-2016-0457"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 1, "90d_avg": 0, "product": "Oracle E-Business Suite", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5, "vulnerability_severity": "Medium"}}]}
{"uuid": "0e313788-ba2d-410e-bb05-acabbd6baf76", "vulnerability": {"vulnId": "CVE-2025-4270", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e313788-ba2d-410e-bb05-acabbd6baf76", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-07-30T12:48:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-30T12:48:45+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A720R | Class: router | Severity: Medium (CVSS 5.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4270", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4270"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 2, "90d_avg": 1, "product": "Totolink A720R", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "7fb20a56-9962-4ba6-b252-d7f08c23f2aa", "vulnerability": {"vulnId": "CVE-2023-41265", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7fb20a56-9962-4ba6-b252-d7f08c23f2aa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-28T18:07:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-28T18:07:43+00:00"}, "scope": {"notes": "Affected: Qlik / Qlik Sense | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-41265", "url": "https://www.cve.org/CVERecord?id=CVE-2023-41265"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Qlik", "30d_avg": 1, "90d_avg": 16, "product": "Qlik Sense", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9c0e0122-fdce-4b17-8713-ea2a377d2cd1", "vulnerability": {"vulnId": "CVE-2022-22536", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9c0e0122-fdce-4b17-8713-ea2a377d2cd1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-03-19T15:10:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-19T15:10:07+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher | Class: app-server | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22536", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22536"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "SAP", "30d_avg": 2, "90d_avg": 3, "product": "NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "05edcbf7-c074-43b6-93ab-1f40da1287ca", "vulnerability": {"vulnId": "CVE-2024-6396", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "05edcbf7-c074-43b6-93ab-1f40da1287ca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-16T09:57:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-16T09:57:34+00:00"}, "scope": {"notes": "Affected: AimStack / Aim | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6396", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6396"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "AimStack", "30d_avg": 0, "90d_avg": 0, "product": "Aim", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3cb85e61-6159-4957-80e9-43088d860eea", "vulnerability": {"vulnId": "CVE-2020-35713", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3cb85e61-6159-4957-80e9-43088d860eea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: Linksys / RE6500 Series | Class: wireless-extender | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35713", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35713"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 1, "vendor": "Linksys", "30d_avg": 1, "90d_avg": 2, "product": "RE6500 Series", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1baa1a35-a997-4869-8193-fe55b3f2529b", "vulnerability": {"vulnId": "CVE-2022-1026", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1baa1a35-a997-4869-8193-fe55b3f2529b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2024-06-08T02:44:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-08T02:44:27+00:00"}, "scope": {"notes": "Affected: Kyocera / Kyocera Multifunction Printers | Class: printer | Severity: High (CVSS 8.6) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1026", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1026"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 0, "vendor": "Kyocera", "30d_avg": 1, "90d_avg": 2, "product": "Kyocera Multifunction Printers", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "bf705deb-67b8-4a20-9007-3a4050d2dc7d", "vulnerability": {"vulnId": "CVE-2024-13161", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bf705deb-67b8-4a20-9007-3a4050d2dc7d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-11T22:37:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-11T22:37:23+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13161", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13161"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 3, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "90bd64b2-c683-486c-9781-87cd8d59d38d", "vulnerability": {"vulnId": "CVE-2022-31814", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "90bd64b2-c683-486c-9781-87cd8d59d38d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-26T03:28:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-26T03:28:15+00:00"}, "scope": {"notes": "Affected: pfSense / pfSense pfBlockerNG | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31814", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31814"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "pfSense", "30d_avg": 1, "90d_avg": 2, "product": "pfSense pfBlockerNG", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e02ff2e0-885b-4669-85d2-4bf477a913a7", "vulnerability": {"vulnId": "CVE-2023-5830", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e02ff2e0-885b-4669-85d2-4bf477a913a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-11T20:14:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-11T20:14:38+00:00"}, "scope": {"notes": "Affected: ColumbiaSoft / Document Locator | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5830", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5830"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "ColumbiaSoft", "30d_avg": 1, "90d_avg": 2, "product": "Document Locator", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c4b0d680-4ae8-41e2-a1f0-80991230c581", "vulnerability": {"vulnId": "CVE-2025-6205", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c4b0d680-4ae8-41e2-a1f0-80991230c581", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2025-11-17T12:03:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-17T12:03:44+00:00"}, "scope": {"notes": "Affected: Dassualt Systems / DELMIA Apriso | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-6205", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6205"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Dassualt Systems", "30d_avg": 4, "90d_avg": 5, "product": "DELMIA Apriso", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "9f17f8a1-e858-4813-9a47-2d04882c069b", "vulnerability": {"vulnId": "CVE-2021-29442", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9f17f8a1-e858-4813-9a47-2d04882c069b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:56+00:00"}, "scope": {"notes": "Affected: Nacos / Nacos | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-29442", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29442"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Nacos", "30d_avg": 0, "90d_avg": 9, "product": "Nacos", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "08a6ed76-fa59-4750-8cf8-63f26a8f3c07", "vulnerability": {"vulnId": "CVE-2023-38433", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "08a6ed76-fa59-4750-8cf8-63f26a8f3c07", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-08-17T23:40:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-17T23:40:29+00:00"}, "scope": {"notes": "Affected: Fujitsu / Fujitsu Real-time Video Transmission Gear \\\"IP series\\\"  | Class: video-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-38433", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38433"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Fujitsu", "30d_avg": 1, "90d_avg": 2, "product": "Fujitsu Real-time Video Transmission Gear \\\"IP series\\\" ", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c9025fdf-a6ea-4fcc-8405-ee0cdd248a68", "vulnerability": {"vulnId": "CVE-2024-32737", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c9025fdf-a6ea-4fcc-8405-ee0cdd248a68", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-22T16:42:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:42:58+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32737", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32737"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CyberPanel", "30d_avg": 0, "90d_avg": 1, "product": "CyberPanel", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "97de8a32-271d-44a6-8f81-081bfbef74f9", "vulnerability": {"vulnId": "CVE-2022-40684", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "97de8a32-271d-44a6-8f81-081bfbef74f9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 96}, "timestamps": {"asserted_at": "2023-10-14T00:41:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T00:41:44+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS, FortiProxy, and FortiSwitchManager | Class: firewall | Severity: Critical (CVSS 9.6) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8220", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40684", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40684"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "33", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 6, "vendor": "Fortinet", "30d_avg": 15, "90d_avg": 13, "product": "FortiOS, FortiProxy, and FortiSwitchManager", "cisa_kev": "yes", "connections": 8220, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.6, "vulnerability_severity": "Critical"}}]}
{"uuid": "3d187670-b39e-4426-8348-4f9caea90dc2", "vulnerability": {"vulnId": "CVE-2024-10081", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3d187670-b39e-4426-8348-4f9caea90dc2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-12-10T13:32:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-10T13:32:32+00:00"}, "scope": {"notes": "Affected: Ericsson / CodeChecker | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-10081", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10081"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Ericsson", "30d_avg": 0, "90d_avg": 2, "product": "CodeChecker", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "b2ac4c6d-ef53-481e-8f12-7794ad6d11cf", "vulnerability": {"vulnId": "CVE-2024-22320", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b2ac4c6d-ef53-481e-8f12-7794ad6d11cf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-03-22T21:00:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-22T21:00:26+00:00"}, "scope": {"notes": "Affected: IBM / IBM Operational Decision Manager | Class: business-intelligence | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22320", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22320"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 0, "vendor": "IBM", "30d_avg": 0, "90d_avg": 0, "product": "IBM Operational Decision Manager", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "f8c538f9-2fcd-4f7c-9752-a472cce01570", "vulnerability": {"vulnId": "CVE-2025-34030", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8c538f9-2fcd-4f7c-9752-a472cce01570", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:38:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:38:05+00:00"}, "scope": {"notes": "Affected: sar2html / sar2html | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34030", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34030"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "sar2html", "30d_avg": 0, "90d_avg": 1, "product": "sar2html", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "b9ba5668-159d-4301-8f37-63860c353ebb", "vulnerability": {"vulnId": "CVE-2019-3396", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b9ba5668-159d-4301-8f37-63860c353ebb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T21:01:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T21:01:48+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-3396", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3396"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Atlassian", "30d_avg": 2, "90d_avg": 10, "product": "Confluence", "cisa_kev": "yes", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ca26b41a-f044-46bd-9a20-65a88b4668df", "vulnerability": {"vulnId": "CVE-2022-50992", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ca26b41a-f044-46bd-9a20-65a88b4668df", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-07-06T18:39:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-06T18:39:49+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-50992", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50992"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3109d1ed-1468-43be-8627-3441953ffa07", "vulnerability": {"vulnId": "CVE-2024-8522", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3109d1ed-1468-43be-8627-3441953ffa07", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-06-08T12:12:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-06-08T12:12:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8522", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8522"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8656282e-b328-410d-86e4-392b2c00279a", "vulnerability": {"vulnId": "CVE-2026-23760", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8656282e-b328-410d-86e4-392b2c00279a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-01-25T00:04:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-25T00:04:42+00:00"}, "scope": {"notes": "Affected: SmarterTools / SmarterMail | Class: email | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-23760", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23760"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 2, "vendor": "SmarterTools", "30d_avg": 0, "90d_avg": 0, "product": "SmarterMail", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "060a7ca3-478e-4876-b3aa-3f5c0c25477c", "vulnerability": {"vulnId": "CVE-2023-34105", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "060a7ca3-478e-4876-b3aa-3f5c0c25477c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-08-17T21:36:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-17T21:36:57+00:00"}, "scope": {"notes": "Affected: Open Source SRS Community / SNS | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34105"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Open Source SRS Community", "30d_avg": 1, "90d_avg": 2, "product": "SNS", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c75dcbed-3692-4979-9aa5-17c25efd12a9", "vulnerability": {"vulnId": "CNVD-2018-24942", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c75dcbed-3692-4979-9aa5-17c25efd12a9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:21:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:21:47+00:00"}, "scope": {"notes": "Affected: TopThink / ThinkPHP5 | Class: web-app-framework | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 369", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "93", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 117, "vendor": "TopThink", "30d_avg": 134, "90d_avg": 147, "product": "ThinkPHP5", "cisa_kev": "no", "connections": 369, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a8b842cf-b325-43ba-8a1d-7a903802fb31", "vulnerability": {"vulnId": "CVE-2025-55182", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a8b842cf-b325-43ba-8a1d-7a903802fb31", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-12-08T12:31:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-12-08T12:31:55+00:00"}, "scope": {"notes": "Affected: Meta / React Server Components | Class: web-app-framework | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 15984", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-55182", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55182"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1880", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 323, "vendor": "Meta", "30d_avg": 133, "90d_avg": 87, "product": "React Server Components", "cisa_kev": "yes", "connections": 15984, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "a9c5d56c-73c3-4f5e-b5c5-79692a3b0108", "vulnerability": {"vulnId": "CVE-2021-42013", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a9c5d56c-73c3-4f5e-b5c5-79692a3b0108", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-19T09:11:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-19T09:11:20+00:00"}, "scope": {"notes": "Affected: Apache / Apache HTTP Server | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 901", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-42013", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42013"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "167", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 193, "vendor": "Apache", "30d_avg": 220, "90d_avg": 241, "product": "Apache HTTP Server", "cisa_kev": "yes", "connections": 901, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d2f46afb-c18c-4ec5-8d35-d1e25005d58c", "vulnerability": {"vulnId": "CVE-2024-6205", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d2f46afb-c18c-4ec5-8d35-d1e25005d58c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-01-22T16:43:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:43:50+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress PayPlus Payment Gateway plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6205", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6205"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress PayPlus Payment Gateway plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fd2117df-8e49-494d-98bb-d3e9ee76a484", "vulnerability": {"vulnId": "CVE-2023-39361", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fd2117df-8e49-494d-98bb-d3e9ee76a484", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-06T22:07:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-06T22:07:16+00:00"}, "scope": {"notes": "Affected: Cacti / Cacti | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-39361", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39361"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 1, "vendor": "Cacti", "30d_avg": 0, "90d_avg": 0, "product": "Cacti", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f0b3bf29-958b-40ea-b29d-cff9118c4895", "vulnerability": {"vulnId": "CVE-2020-1956", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f0b3bf29-958b-40ea-b29d-cff9118c4895", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-05-11T07:31:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-11T07:31:41+00:00"}, "scope": {"notes": "Affected: Apache / Apache Kylin | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-1956", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1956"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 4, "90d_avg": 3, "product": "Apache Kylin", "cisa_kev": "yes", "connections": 33, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "0206238f-7930-4227-96fd-22cb0916f05b", "vulnerability": {"vulnId": "CVE-2024-29059", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0206238f-7930-4227-96fd-22cb0916f05b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-04-27T04:54:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-27T04:54:55+00:00"}, "scope": {"notes": "Affected: Microsoft / .NET Framework | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-29059", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 7, "vendor": "Microsoft", "30d_avg": 10, "90d_avg": 7, "product": ".NET Framework", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "01f9f907-f180-444b-b18f-cece6e670b8c", "vulnerability": {"vulnId": "CVE-2017-1000486", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "01f9f907-f180-444b-b18f-cece6e670b8c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:15:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:15:09+00:00"}, "scope": {"notes": "Affected: PrimeFaces / PrimeTek | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 49", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-1000486", "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000486"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "PrimeFaces", "30d_avg": 2, "90d_avg": 2, "product": "PrimeTek", "cisa_kev": "yes", "connections": 49, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "45b68f03-774f-46fc-944d-25e09f4a5965", "vulnerability": {"vulnId": "CVE-2023-1389", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "45b68f03-774f-46fc-944d-25e09f4a5965", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-13T16:14:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:14:26+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link Archer AX21 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1389", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1389"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "TP-Link", "30d_avg": 2, "90d_avg": 3, "product": "TP-Link Archer AX21", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "dbd06f09-fd26-417e-ad42-b14d005a5755", "vulnerability": {"vulnId": "CVE-2015-1427", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dbd06f09-fd26-417e-ad42-b14d005a5755", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T20:52:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:52:26+00:00"}, "scope": {"notes": "Affected: Elastic / Elasticsearch | Class: database | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-1427", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1427"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 1, "vendor": "Elastic", "30d_avg": 2, "90d_avg": 3, "product": "Elasticsearch", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2a5ff222-f05b-40a6-a0cf-514901862678", "vulnerability": {"vulnId": "CVE-2026-34910", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2a5ff222-f05b-40a6-a0cf-514901862678", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-07-06T16:13:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-06T16:13:45+00:00"}, "scope": {"notes": "Affected: Ubiquiti / Ubiquiti UniFi | Class: router | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-34910", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34910"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ubiquiti", "30d_avg": 0, "90d_avg": 0, "product": "Ubiquiti UniFi", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "2f1a74f4-0585-4ed9-bd8b-ea05195f8478", "vulnerability": {"vulnId": "CVE-2022-25486", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2f1a74f4-0585-4ed9-bd8b-ea05195f8478", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: CuppaCMS / CuppaCMS | Class: cms | Severity: High (CVSS 7.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25486", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25486"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "CuppaCMS", "30d_avg": 1, "90d_avg": 2, "product": "CuppaCMS", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "1a6c5ef1-d138-47d1-9c81-cfb755918ced", "vulnerability": {"vulnId": "CVE-2025-64446", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1a6c5ef1-d138-47d1-9c81-cfb755918ced", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-15T00:44:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-15T00:44:04+00:00"}, "scope": {"notes": "Affected: Fortinet / Fortinet FortiWeb | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-64446", "url": "https://www.cve.org/CVERecord?id=CVE-2025-64446"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Fortinet", "30d_avg": 0, "90d_avg": 2, "product": "Fortinet FortiWeb", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e755a59e-5b54-4bae-9e57-f74bb64bf0c2", "vulnerability": {"vulnId": "CVE-2019-19825", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e755a59e-5b54-4bae-9e57-f74bb64bf0c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-23T21:36:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-23T21:36:39+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink Realtek SDK based routers | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-19825", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19825"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 2, "90d_avg": 3, "product": "Totolink Realtek SDK based routers", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3ebadbe6-561c-4380-b248-848132fc78fb", "vulnerability": {"vulnId": "EDB-50753", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3ebadbe6-561c-4380-b248-848132fc78fb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-06-22T09:30:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-22T09:30:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress dzs-zoomsounds plugin | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-50753", "url": "https://www.exploit-db.com/exploits/50753"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress dzs-zoomsounds plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "72bd2b61-3525-4f37-875f-a77f4a52fd63", "vulnerability": {"vulnId": "CVE-2021-22911", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "72bd2b61-3525-4f37-875f-a77f4a52fd63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Rocket.Chat / Rocket.Chat | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22911", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22911"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Rocket.Chat", "30d_avg": 1, "90d_avg": 2, "product": "Rocket.Chat", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "52bb76fb-dd07-49dd-944e-a99593fef48f", "vulnerability": {"vulnId": "CVE-2019-1653", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "52bb76fb-dd07-49dd-944e-a99593fef48f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-13T16:08:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:08:08+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV320/RV325 | Class: router | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 70", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-1653", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1653"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "45", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 42, "vendor": "Cisco", "30d_avg": 57, "90d_avg": 61, "product": "Cisco RV320/RV325", "cisa_kev": "yes", "connections": 70, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "31b6e433-c4aa-4a42-9b0e-33f3a3765380", "vulnerability": {"vulnId": "CVE-2021-25114", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "31b6e433-c4aa-4a42-9b0e-33f3a3765380", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-11T10:29:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-11T10:29:55+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Paid Memberships Pro plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-25114", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25114"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Paid Memberships Pro plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bfdda251-a7f1-49e3-ab40-9ee1e841343c", "vulnerability": {"vulnId": "CVE-2023-1671", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bfdda251-a7f1-49e3-ab40-9ee1e841343c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:42+00:00"}, "scope": {"notes": "Affected: Sophos / Sophos Web Appliance | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1671", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1671"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Sophos", "30d_avg": 1, "90d_avg": 2, "product": "Sophos Web Appliance", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bbb4a2b0-5405-4ad4-a26f-cbb7cb6b4c3f", "vulnerability": {"vulnId": "CVE-2021-39312", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bbb4a2b0-5405-4ad4-a26f-cbb7cb6b4c3f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-06-03T17:16:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-03T17:16:36+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress The True Ranker plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39312", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39312"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress The True Ranker plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "d4ce1a3d-b359-4924-8a1e-2eb57f9008b3", "vulnerability": {"vulnId": "CVE-2021-45420", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d4ce1a3d-b359-4924-8a1e-2eb57f9008b3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T22:01:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T22:01:37+00:00"}, "scope": {"notes": "Affected: Emerson Dixell / XWEB-500 | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-45420", "url": "https://www.cve.org/CVERecord?id=CVE-2021-45420"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Emerson Dixell", "30d_avg": 1, "90d_avg": 2, "product": "XWEB-500", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a02279e6-a340-44fa-83fd-41d68ff15bfe", "vulnerability": {"vulnId": "CVE-2024-6670", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a02279e6-a340-44fa-83fd-41d68ff15bfe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-20T14:39:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-20T14:39:24+00:00"}, "scope": {"notes": "Affected: Progress / WhatsUp Gold | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6670", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6670"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Progress", "30d_avg": 4, "90d_avg": 3, "product": "WhatsUp Gold", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "35ca9e87-e57a-451a-9dd1-1780d60ba9ba", "vulnerability": {"vulnId": "CVE-2022-31126", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "35ca9e87-e57a-451a-9dd1-1780d60ba9ba", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:30+00:00"}, "scope": {"notes": "Affected: Roxy-WI / Roxy-WI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31126", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31126"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Roxy-WI", "30d_avg": 1, "90d_avg": 2, "product": "Roxy-WI", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ed62bca8-9e0e-49c1-ae3a-cb8ff2fc0f9a", "vulnerability": {"vulnId": "CVE-2026-4631", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ed62bca8-9e0e-49c1-ae3a-cb8ff2fc0f9a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-08T12:18:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-08T12:18:53+00:00"}, "scope": {"notes": "Affected: Cockpit / Cockpit | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-4631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4631"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Cockpit", "30d_avg": 0, "90d_avg": 0, "product": "Cockpit", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5f2c8209-9044-470a-9454-8553efdfa193", "vulnerability": {"vulnId": "CVE-2024-1212", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5f2c8209-9044-470a-9454-8553efdfa193", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-03-29T09:59:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-29T09:59:22+00:00"}, "scope": {"notes": "Affected: Progress / Kemp LoadMaster | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1212", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1212"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 2, "product": "Kemp LoadMaster", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "ff07814f-9e90-47c6-9c09-b2be4b2534d6", "vulnerability": {"vulnId": "CVE-2022-0827", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff07814f-9e90-47c6-9c09-b2be4b2534d6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:16:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:16:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Bestbooks plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0827", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0827"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Bestbooks plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "596b4552-e2ce-403a-974b-46288506d108", "vulnerability": {"vulnId": "CVE-2025-0868", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "596b4552-e2ce-403a-974b-46288506d108", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-06-08T20:31:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-08T20:31:38+00:00"}, "scope": {"notes": "Affected: Arc53 / DocsGPT | Class: ai-system | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-0868", "url": "https://www.cve.org/CVERecord?id=CVE-2025-0868"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "Arc53", "30d_avg": 1, "90d_avg": 2, "product": "DocsGPT", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "88983f85-20ce-4061-a21b-bb2b33ad8ddc", "vulnerability": {"vulnId": "CVE-2024-0352", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "88983f85-20ce-4061-a21b-bb2b33ad8ddc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-22T10:59:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-22T10:59:21+00:00"}, "scope": {"notes": "Affected: Likeshop / Likeshop | Class: unknown | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0352", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0352"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "unknown", "7d_avg": 0, "vendor": "Likeshop", "30d_avg": 0, "90d_avg": 2, "product": "Likeshop", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "914fa498-a21d-43b7-9263-c1d3b2ba112f", "vulnerability": {"vulnId": "CVE-2020-24949", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "914fa498-a21d-43b7-9263-c1d3b2ba112f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-11-10T11:02:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-10T11:02:51+00:00"}, "scope": {"notes": "Affected: PHP-Fusion / PHP-Fusion | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-24949", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24949"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "PHP-Fusion", "30d_avg": 0, "90d_avg": 2, "product": "PHP-Fusion", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "7a1e7be4-e27e-4b87-89de-b81460584fcc", "vulnerability": {"vulnId": "CVE-2019-18371", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7a1e7be4-e27e-4b87-89de-b81460584fcc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-02T17:03:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-02T17:03:28+00:00"}, "scope": {"notes": "Affected: Xiaomi / Xiaomi Mi WiFi R3G | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18371", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18371"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Xiaomi", "30d_avg": 0, "90d_avg": 1, "product": "Xiaomi Mi WiFi R3G", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "0942873a-82f1-4a41-b507-c2209595fd37", "vulnerability": {"vulnId": "CVE-2022-29014", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0942873a-82f1-4a41-b507-c2209595fd37", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:29+00:00"}, "scope": {"notes": "Affected: Razer / Razer Sila | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29014", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29014"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Razer", "30d_avg": 0, "90d_avg": 2, "product": "Razer Sila", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "bd7444c2-a4d1-426b-8a5c-2406cfbe9faa", "vulnerability": {"vulnId": "CVE-2025-34046", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bd7444c2-a4d1-426b-8a5c-2406cfbe9faa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:56:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:56:58+00:00"}, "scope": {"notes": "Affected: Shanghai Fanwei Network Technology / Panwei e-office | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34046", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34046"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Shanghai Fanwei Network Technology", "30d_avg": 1, "90d_avg": 1, "product": "Panwei e-office", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "437840e9-18a2-4b28-bf41-0fb29deb1c82", "vulnerability": {"vulnId": "CVE-2024-12847", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "437840e9-18a2-4b28-bf41-0fb29deb1c82", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-07T22:39:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-07T22:39:52+00:00"}, "scope": {"notes": "Affected: Netgear / Netgear DGN1000 | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 297", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-12847", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12847"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "277", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 276, "vendor": "Netgear", "30d_avg": 266, "90d_avg": 262, "product": "Netgear DGN1000", "cisa_kev": "no", "connections": 297, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "vulnerability": {"vulnId": "CVE-2025-34047", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7a29ec24-0c08-49c3-b85c-d778e0dbc6c7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:50:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:50:51+00:00"}, "scope": {"notes": "Affected: Beijing NetGuard Nebula Information Technology / Leadsec VPN | Class: vpn | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34047", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34047"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 1, "vendor": "Beijing NetGuard Nebula Information Technology", "30d_avg": 1, "90d_avg": 1, "product": "Leadsec VPN", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6d0d707b-b9a4-41e4-bf52-7517a85432cd", "vulnerability": {"vulnId": "CVE-2025-34037", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6d0d707b-b9a4-41e4-bf52-7517a85432cd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-09T08:18:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-09T08:18:11+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys E-Series | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 181", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34037", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34037"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "15", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 25, "vendor": "Linksys", "30d_avg": 19, "90d_avg": 8, "product": "Linksys E-Series", "cisa_kev": "no", "connections": 181, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "79af8766-9cdc-48f4-9546-bb3fa0d58c31", "vulnerability": {"vulnId": "CVE-2025-34043", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "79af8766-9cdc-48f4-9546-bb3fa0d58c31", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-07T22:44:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-07T22:44:11+00:00"}, "scope": {"notes": "Affected: Vacron / Network Video Recorder (NVR) | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 106", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34043", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34043"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "104", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 86, "vendor": "Vacron", "30d_avg": 82, "90d_avg": 85, "product": "Network Video Recorder (NVR)", "cisa_kev": "no", "connections": 106, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "29a51980-d88d-4f32-9c6c-3acfdfa29f5d", "vulnerability": {"vulnId": "CVE-2022-4984", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "29a51980-d88d-4f32-9c6c-3acfdfa29f5d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:50:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:50:57+00:00"}, "scope": {"notes": "Affected: Qingdao Easysoft / ZenTao | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4984", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4984"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Qingdao Easysoft", "30d_avg": 1, "90d_avg": 1, "product": "ZenTao", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "3c47d9aa-7f7c-47cd-bbcc-3379ba172cdc", "vulnerability": {"vulnId": "CVE-2024-7314", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3c47d9aa-7f7c-47cd-bbcc-3379ba172cdc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:50:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:50:54+00:00"}, "scope": {"notes": "Affected: anji-plus / AJ-Report | Class: business-intelligence | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7314", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 1, "vendor": "anji-plus", "30d_avg": 2, "90d_avg": 3, "product": "AJ-Report", "cisa_kev": "no", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "fc7a6844-3b0d-4dc8-b4ce-17f382001011", "vulnerability": {"vulnId": "CVE-2025-34036", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fc7a6844-3b0d-4dc8-b4ce-17f382001011", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-07T23:26:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-07T23:26:50+00:00"}, "scope": {"notes": "Affected: Shenzhen TVT / CCTV-DVR (rebranded by multiple vendors) | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 139", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34036", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34036"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "138", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 136, "vendor": "Shenzhen TVT", "30d_avg": 132, "90d_avg": 134, "product": "CCTV-DVR (rebranded by multiple vendors)", "cisa_kev": "no", "connections": 139, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a7b00775-6b25-4c33-82c6-d49817fc734c", "vulnerability": {"vulnId": "CVE-2025-34031", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a7b00775-6b25-4c33-82c6-d49817fc734c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:42:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:42:43+00:00"}, "scope": {"notes": "Affected: Moodle / Moodle JSmol plugin | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34031", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34031"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Moodle", "30d_avg": 0, "90d_avg": 1, "product": "Moodle JSmol plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "29f4e76b-b337-4f14-aa39-cf75e1a7a2e8", "vulnerability": {"vulnId": "CVE-2025-34023", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "29f4e76b-b337-4f14-aa39-cf75e1a7a2e8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-15T19:41:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-15T19:41:19+00:00"}, "scope": {"notes": "Affected: Karel / Karel IP Phone IP1211 | Class: other-software | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34023", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34023"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Karel", "30d_avg": 1, "90d_avg": 3, "product": "Karel IP Phone IP1211", "cisa_kev": "no", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6e887eaf-bfc5-4911-847b-c3bb2ac72739", "vulnerability": {"vulnId": "CVE-2025-34040", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6e887eaf-bfc5-4911-847b-c3bb2ac72739", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-19T15:19:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-19T15:19:25+00:00"}, "scope": {"notes": "Affected: Zhiyuan / Zhiyuan OA | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34040", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34040"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Zhiyuan", "30d_avg": 0, "90d_avg": 0, "product": "Zhiyuan OA", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2cac4588-a893-4ae3-9919-922f0ae00b96", "vulnerability": {"vulnId": "EDB-49327", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2cac4588-a893-4ae3-9919-922f0ae00b96", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T23:23:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T23:23:01+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Epsilon Framework Multiple Themes | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-49327", "url": "https://www.exploit-db.com/exploits/49327"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Epsilon Framework Multiple Themes", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e928a464-1133-4acf-a03c-24d692ff496a", "vulnerability": {"vulnId": "CVE-2021-4374", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e928a464-1133-4acf-a03c-24d692ff496a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T15:36:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T15:36:35+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Automatic Plugin for WordPress | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-4374", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4374"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 3, "product": "Wordpress Automatic Plugin for WordPress", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e6b26e9d-46ec-4db8-8d50-aae54ddaf061", "vulnerability": {"vulnId": "CVE-2023-23752", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e6b26e9d-46ec-4db8-8d50-aae54ddaf061", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:00:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:01+00:00"}, "scope": {"notes": "Affected: Open Source Matters, Inc/Joomla community / Joomla | Class: cms | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-23752", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23752"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Open Source Matters, Inc/Joomla community", "30d_avg": 2, "90d_avg": 3, "product": "Joomla", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f5772856-05e8-4057-9431-7fa5d570eab3", "vulnerability": {"vulnId": "EDB-50321", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f5772856-05e8-4057-9431-7fa5d570eab3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-19T02:17:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T02:17:00+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress 3DPrint Lite plugin | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-50321", "url": "https://www.exploit-db.com/exploits/50321"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress 3DPrint Lite plugin", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "669aa01a-e5e5-412c-8648-ede671705d4d", "vulnerability": {"vulnId": "CVE-2022-0760", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "669aa01a-e5e5-412c-8648-ede671705d4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:09:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:09:43+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Simple Link Directory plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0760", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0760"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Simple Link Directory plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5aa71cae-48ca-4bf2-8932-5c2d0ae44591", "vulnerability": {"vulnId": "CVE-2023-34659", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5aa71cae-48ca-4bf2-8932-5c2d0ae44591", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:51+00:00"}, "scope": {"notes": "Affected: JEECG / jeecg-boot | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34659", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34659"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "JEECG", "30d_avg": 1, "90d_avg": 2, "product": "jeecg-boot", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e5dcbf6a-71f2-4247-b3e5-3fb6a9eeffb1", "vulnerability": {"vulnId": "CVE-2020-7136", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e5dcbf6a-71f2-4247-b3e5-3fb6a9eeffb1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-14T00:31:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-14T00:31:47+00:00"}, "scope": {"notes": "Affected: HPE / HPE Smart Update Manager (SUM) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-7136", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7136"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "HPE", "30d_avg": 4, "90d_avg": 3, "product": "HPE Smart Update Manager (SUM)", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1fd154ab-6654-47bf-ba9f-e21041572d53", "vulnerability": {"vulnId": "CVE-2020-13638", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fd154ab-6654-47bf-ba9f-e21041572d53", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T16:28:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-18T16:28:49+00:00"}, "scope": {"notes": "Affected: rConfig / rConfig | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13638", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13638"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "rConfig", "30d_avg": 4, "90d_avg": 4, "product": "rConfig", "cisa_kev": "no", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3fcfe82f-097a-4011-a255-d6994a29964f", "vulnerability": {"vulnId": "CVE-2025-41646", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3fcfe82f-097a-4011-a255-d6994a29964f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-30T12:41:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-30T12:41:00+00:00"}, "scope": {"notes": "Affected: Revolution PI / Revolution PI webstatus and others | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-41646", "url": "https://www.cve.org/CVERecord?id=CVE-2025-41646"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Revolution PI", "30d_avg": 0, "90d_avg": 1, "product": "Revolution PI webstatus and others", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4d659fd7-737d-44bf-8912-b49f5add9299", "vulnerability": {"vulnId": "CVE-2021-34624", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4d659fd7-737d-44bf-8912-b49f5add9299", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress ProfilePress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-34624", "url": "https://www.cve.org/CVERecord?id=CVE-2021-34624"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress ProfilePress plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5508e753-fd52-4709-87e0-2539f743aeb8", "vulnerability": {"vulnId": "CVE-2025-47812", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5508e753-fd52-4709-87e0-2539f743aeb8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-14T07:29:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-14T07:29:36+00:00"}, "scope": {"notes": "Affected: wftpserver.com / Wing FTP Server | Class: file-transfer | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-47812", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47812"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 1, "vendor": "wftpserver.com", "30d_avg": 0, "90d_avg": 2, "product": "Wing FTP Server", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a266f19f-dcf2-41e8-bb3a-6824548d7220", "vulnerability": {"vulnId": "CVE-2020-12832", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a266f19f-dcf2-41e8-bb3a-6824548d7220", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T23:26:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T23:26:34+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Simple File List plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-12832", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12832"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress Simple File List plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "58d97ad4-9ebf-46db-9b3b-ab35af246509", "vulnerability": {"vulnId": "CVE-2017-10271", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "58d97ad4-9ebf-46db-9b3b-ab35af246509", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-13T19:27:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T19:27:19+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-10271", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10271"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 2, "vendor": "Oracle", "30d_avg": 7, "90d_avg": 4, "product": "Oracle Weblogic Server", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "68a48142-74f6-45d6-9917-8febc6d561ca", "vulnerability": {"vulnId": "CVE-2024-34257", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "68a48142-74f6-45d6-9917-8febc6d561ca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-08-13T22:56:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-13T22:56:46+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink EX1800T | Class: wireless-extender | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-34257", "url": "https://www.cve.org/CVERecord?id=CVE-2024-34257"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 1, "90d_avg": 2, "product": "Totolink EX1800T", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "84d6b865-b0be-4c73-bb8d-5b08f242558d", "vulnerability": {"vulnId": "EDB-41471", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "84d6b865-b0be-4c73-bb8d-5b08f242558d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:03:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:03:09+00:00"}, "scope": {"notes": "Affected: MVPower / MVPower DVR | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 4273", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-41471", "url": "https://www.exploit-db.com/exploits/41471"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "158", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 172, "vendor": "MVPower", "30d_avg": 159, "90d_avg": 290, "product": "MVPower DVR", "cisa_kev": "no", "connections": 4273, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "7265bbed-8581-4fe4-a86c-4d9b6cab877b", "vulnerability": {"vulnId": "CVE-2024-21887", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7265bbed-8581-4fe4-a86c-4d9b6cab877b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2024-01-18T01:04:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-18T01:04:36+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Secure Connect and Policy Secure | Class: vpn | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 58", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21887", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21887"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "9", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 5, "vendor": "Ivanti", "30d_avg": 7, "90d_avg": 8, "product": "Ivanti Secure Connect and Policy Secure", "cisa_kev": "yes", "connections": 58, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "7c508aff-b6b7-4d02-b3a7-05485ba441a7", "vulnerability": {"vulnId": "CVE-2016-5674", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7c508aff-b6b7-4d02-b3a7-05485ba441a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-12T12:17:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-12T12:17:27+00:00"}, "scope": {"notes": "Affected: NETGEAR/NUUO / NETGEAR ReadyNAS Surveillance,  NUUO NVRmini, NUUO NVRsolo | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-5674", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5674"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "NETGEAR/NUUO", "30d_avg": 6, "90d_avg": 4, "product": "NETGEAR ReadyNAS Surveillance,  NUUO NVRmini, NUUO NVRsolo", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6213ab03-e46d-47dd-9e5d-5e258949593d", "vulnerability": {"vulnId": "CVE-2024-48307", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6213ab03-e46d-47dd-9e5d-5e258949593d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-24T07:06:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-24T07:06:45+00:00"}, "scope": {"notes": "Affected: JEECG / jeecg-boot | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-48307", "url": "https://www.cve.org/CVERecord?id=CVE-2024-48307"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "JEECG", "30d_avg": 5, "90d_avg": 3, "product": "jeecg-boot", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e45a558c-e5f5-45ac-93e6-90e0bcb1185b", "vulnerability": {"vulnId": "CVE-2023-32563", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e45a558c-e5f5-45ac-93e6-90e0bcb1185b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:50+00:00"}, "scope": {"notes": "Affected: Ivanti / Avalanche | Class: mobile-device-management | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-32563", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32563"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 3, "product": "Avalanche", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "af412300-253a-4356-b257-a975afb15962", "vulnerability": {"vulnId": "EDB-50637", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "af412300-253a-4356-b257-a975afb15962", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:57:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:27+00:00"}, "scope": {"notes": "Affected: OpenSIS / Student Information System v8 | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-50637", "url": "https://www.exploit-db.com/exploits/50637"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "OpenSIS", "30d_avg": 4, "90d_avg": 3, "product": "Student Information System v8", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "523b7685-0e6f-4444-931e-e26a0343d89c", "vulnerability": {"vulnId": "CVE-2020-15415", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "523b7685-0e6f-4444-931e-e26a0343d89c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-01T08:57:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-01T08:57:51+00:00"}, "scope": {"notes": "Affected: Draytek / Vigor3900, Vigor2960, Vigor300B | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15415", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15415"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Draytek", "30d_avg": 1, "90d_avg": 2, "product": "Vigor3900, Vigor2960, Vigor300B", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "55c28a81-725f-4e1d-93be-207bb6a74f71", "vulnerability": {"vulnId": "CVE-2024-0305", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "55c28a81-725f-4e1d-93be-207bb6a74f71", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-03-17T20:10:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-17T20:10:07+00:00"}, "scope": {"notes": "Affected: Guangzhou Yingke Electronic Technology / Ncast | Class: video-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0305", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0305"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Guangzhou Yingke Electronic Technology", "30d_avg": 0, "90d_avg": 0, "product": "Ncast", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "4dd496c8-48f8-4e02-9fe3-7064c55717c4", "vulnerability": {"vulnId": "CVE-2025-47916", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4dd496c8-48f8-4e02-9fe3-7064c55717c4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-06-06T20:40:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-06T20:40:10+00:00"}, "scope": {"notes": "Affected: Invision Power Services / Invision Community | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-47916", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47916"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Invision Power Services", "30d_avg": 0, "90d_avg": 1, "product": "Invision Community", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "cecbba54-6638-45f9-8ba9-b54ec4e123ae", "vulnerability": {"vulnId": "CVE-2024-50498", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cecbba54-6638-45f9-8ba9-b54ec4e123ae", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-06-08T20:31:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-08T20:31:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WP Query Console plugin | Class: cms | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-50498", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50498"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress WP Query Console plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "4f6e9c0b-634f-47d1-9208-feaea5b2ef00", "vulnerability": {"vulnId": "CVE-2023-26775", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4f6e9c0b-634f-47d1-9208-feaea5b2ef00", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2024-02-10T14:25:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-10T14:25:05+00:00"}, "scope": {"notes": "Affected: Monitorr / Monitorr | Class: network-monitoring | Severity: High (CVSS 7.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26775", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26775"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 1, "vendor": "Monitorr", "30d_avg": 8, "90d_avg": 7, "product": "Monitorr", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "c398548d-0ad4-4a4d-b79b-e67b85c873fe", "vulnerability": {"vulnId": "CVE-2024-27199", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c398548d-0ad4-4a4d-b79b-e67b85c873fe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2024-03-17T12:34:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-17T12:34:19+00:00"}, "scope": {"notes": "Affected: JetBrains / TeamCity | Class: other-software | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27199", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27199"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "JetBrains", "30d_avg": 5, "90d_avg": 5, "product": "TeamCity", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "8373134c-0e55-4d5d-8890-0ed275227c26", "vulnerability": {"vulnId": "CVE-2019-14251", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8373134c-0e55-4d5d-8890-0ed275227c26", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-14T22:01:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-14T22:01:10+00:00"}, "scope": {"notes": "Affected: Temenos / Temenos T24 | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-14251", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14251"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Temenos", "30d_avg": 5, "90d_avg": 4, "product": "Temenos T24", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c9b9ba1c-d49d-4b38-b5b9-ff7116179184", "vulnerability": {"vulnId": "CVE-2021-35250", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c9b9ba1c-d49d-4b38-b5b9-ff7116179184", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-11-13T17:38:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-13T17:38:10+00:00"}, "scope": {"notes": "Affected: SolarWinds / Serv-U | Class: file-transfer | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35250", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35250"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "SolarWinds", "30d_avg": 1, "90d_avg": 2, "product": "Serv-U", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3295e113-1664-46c9-954b-a3818cde95b5", "vulnerability": {"vulnId": "CVE-2010-0219", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3295e113-1664-46c9-954b-a3818cde95b5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T13:54:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T13:54:56+00:00"}, "scope": {"notes": "Affected: Apache / Axis2 | Class: web-app-framework | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 37", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2010-0219", "url": "https://www.cve.org/CVERecord?id=CVE-2010-0219"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Apache", "30d_avg": 5, "90d_avg": 5, "product": "Axis2", "cisa_kev": "no", "connections": 37, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e46b6320-d86a-4792-a251-3e070d296714", "vulnerability": {"vulnId": "CVE-2021-32030", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e46b6320-d86a-4792-a251-3e070d296714", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:57+00:00"}, "scope": {"notes": "Affected: ASUS / GT-AC2900 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 212", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-32030", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32030"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "ASUS", "30d_avg": 2, "90d_avg": 3, "product": "GT-AC2900", "cisa_kev": "yes", "connections": 212, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9e77fab8-d2eb-4539-b26f-ac91e8593ef7", "vulnerability": {"vulnId": "CVE-2019-12990", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9e77fab8-d2eb-4539-b26f-ac91e8593ef7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:13:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:13:28+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12990", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12990"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "Citrix", "30d_avg": 5, "90d_avg": 4, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "69ab8a5f-827b-4377-b8f2-42f6ee16ec9f", "vulnerability": {"vulnId": "CVE-2019-11510", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "69ab8a5f-827b-4377-b8f2-42f6ee16ec9f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T14:56:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:01+00:00"}, "scope": {"notes": "Affected: Pulse Secure / Pulse Secure VPN | Class: vpn | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11510", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11510"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 3, "vendor": "Pulse Secure", "30d_avg": 6, "90d_avg": 7, "product": "Pulse Secure VPN", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "cb4b4a23-51db-448f-af86-1453031e0fa3", "vulnerability": {"vulnId": "CVE-2018-19365", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cb4b4a23-51db-448f-af86-1453031e0fa3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T14:45:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:45:01+00:00"}, "scope": {"notes": "Affected: Wowza Media Systems / Wowza Streaming Engine | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-19365", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19365"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Wowza Media Systems", "30d_avg": 0, "90d_avg": 1, "product": "Wowza Streaming Engine", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "5489a588-b910-4cf9-a7c0-44c834456a57", "vulnerability": {"vulnId": "CVE-2022-2487", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5489a588-b910-4cf9-a7c0-44c834456a57", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN535K2 and WN535K3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2487", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2487"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "WAVLINK", "30d_avg": 1, "90d_avg": 2, "product": "WAVLINK WN535K2 and WN535K3", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5a2c9786-fe34-4997-91d4-5fca0c362cb4", "vulnerability": {"vulnId": "CVE-2024-23897", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5a2c9786-fe34-4997-91d4-5fca0c362cb4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-30T06:06:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-30T06:06:30+00:00"}, "scope": {"notes": "Affected: Jenkins / Jenkins | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1357", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-23897", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23897"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 5, "vendor": "Jenkins", "30d_avg": 6, "90d_avg": 2, "product": "Jenkins", "cisa_kev": "yes", "connections": 1357, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7a7d80b1-cca0-41f1-998f-d8da2af67f52", "vulnerability": {"vulnId": "CVE-2024-52875", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7a7d80b1-cca0-41f1-998f-d8da2af67f52", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-02-06T17:41:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-06T17:41:26+00:00"}, "scope": {"notes": "Affected: GFI / Kerio Control | Class: firewall | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-52875", "url": "https://www.cve.org/CVERecord?id=CVE-2024-52875"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "GFI", "30d_avg": 5, "90d_avg": 3, "product": "Kerio Control", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "9feb221a-df33-4d6a-8f25-73beaa206026", "vulnerability": {"vulnId": "CVE-2023-37679", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9feb221a-df33-4d6a-8f25-73beaa206026", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-05-25T19:12:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-05-25T19:12:29+00:00"}, "scope": {"notes": "Affected: NextGen Healthcare / Mirth Connect | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 2496", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-37679", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37679"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "NextGen Healthcare", "30d_avg": 6, "90d_avg": 13, "product": "Mirth Connect", "cisa_kev": "no", "connections": 2496, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a391499d-3af1-4373-a3da-949fa4756a9a", "vulnerability": {"vulnId": "CVE-2021-46422", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a391499d-3af1-4373-a3da-949fa4756a9a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:56:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:56:55+00:00"}, "scope": {"notes": "Affected: Telesquare / Telesquare SDT-CW3B1 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-46422", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46422"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Telesquare", "30d_avg": 1, "90d_avg": 3, "product": "Telesquare SDT-CW3B1", "cisa_kev": "no", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "10a6c608-d75a-4065-9c2b-35220e28ebfc", "vulnerability": {"vulnId": "CVE-2019-16920", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "10a6c608-d75a-4065-9c2b-35220e28ebfc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link  DIR-615, DIR-655C, DIR-825, DIR-835, DIR-855L, DIR-866L, DIR-652, DIR-862L, DHP-1565, DAP-1533 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-16920", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16920"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "D-Link", "30d_avg": 6, "90d_avg": 4, "product": "D-Link  DIR-615, DIR-655C, DIR-825, DIR-835, DIR-855L, DIR-866L, DIR-652, DIR-862L, DHP-1565, DAP-1533", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6b2c9a0e-2c70-4342-80d2-17d5db58f0c5", "vulnerability": {"vulnId": "EDB-45025", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b2c9a0e-2c70-4342-80d2-17d5db58f0c5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:00:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:38+00:00"}, "scope": {"notes": "Affected: Apache / Hadoop (YARN ResourceManager) | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2724", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-45025", "url": "https://www.exploit-db.com/exploits/45025"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "Apache", "30d_avg": 4, "90d_avg": 5, "product": "Hadoop (YARN ResourceManager)", "cisa_kev": "no", "connections": 2724, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "0a99a984-5895-43ee-8281-d443495aabea", "vulnerability": {"vulnId": "CVE-2023-22527", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0a99a984-5895-43ee-8281-d443495aabea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-01-22T09:33:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-22T09:33:05+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22527", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22527"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "Atlassian", "30d_avg": 8, "90d_avg": 20, "product": "Confluence", "cisa_kev": "yes", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "8c27ac0b-e9d6-4db3-9653-1738d37dbc63", "vulnerability": {"vulnId": "CVE-2021-3577", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8c27ac0b-e9d6-4db3-9653-1738d37dbc63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:00+00:00"}, "scope": {"notes": "Affected: Motorola / Binatone Hubble Camera | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3577", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3577"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Motorola", "30d_avg": 1, "90d_avg": 2, "product": "Binatone Hubble Camera", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "e303c7aa-9fa8-4e21-ac14-b83b25489dd7", "vulnerability": {"vulnId": "CVE-2024-1709", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e303c7aa-9fa8-4e21-ac14-b83b25489dd7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-21T21:28:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-21T21:28:13+00:00"}, "scope": {"notes": "Affected: ConnectWise / ScreenConnect | Class: remote-access | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 60", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1709", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1709"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 11, "vendor": "ConnectWise", "30d_avg": 10, "90d_avg": 5, "product": "ScreenConnect", "cisa_kev": "yes", "connections": 60, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c6db9371-7e2f-4f34-8b70-fab2965a742a", "vulnerability": {"vulnId": "CVE-2021-34473", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c6db9371-7e2f-4f34-8b70-fab2965a742a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:24:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:24:52+00:00"}, "scope": {"notes": "Affected: Microsoft / Exchange | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 135", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-34473", "url": "https://www.cve.org/CVERecord?id=CVE-2021-34473"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 3, "vendor": "Microsoft", "30d_avg": 6, "90d_avg": 5, "product": "Exchange", "cisa_kev": "yes", "connections": 135, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "655ee8c0-5f82-4c81-bb4c-e624297a8e74", "vulnerability": {"vulnId": "CVE-2021-21978", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "655ee8c0-5f82-4c81-bb4c-e624297a8e74", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: VMware / VMware View Planner 4.x | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21978", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21978"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "VMware", "30d_avg": 1, "90d_avg": 2, "product": "VMware View Planner 4.x", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "51d5a857-305c-4c02-8c6b-c32ec20e645a", "vulnerability": {"vulnId": "CVE-2018-14918", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "51d5a857-305c-4c02-8c6b-c32ec20e645a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:38:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:38:47+00:00"}, "scope": {"notes": "Affected: LOYTEC / LOYTEC LGATE-902 | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-14918", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14918"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "LOYTEC", "30d_avg": 0, "90d_avg": 3, "product": "LOYTEC LGATE-902", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9869cc69-9a74-44a6-9901-b212e14367d0", "vulnerability": {"vulnId": "CVE-2022-25485", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9869cc69-9a74-44a6-9901-b212e14367d0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: CuppaCMS / CuppaCMS | Class: cms | Severity: High (CVSS 7.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25485", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25485"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "CuppaCMS", "30d_avg": 1, "90d_avg": 2, "product": "CuppaCMS", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "33947c86-829d-44af-a7f6-891fc4a3a528", "vulnerability": {"vulnId": "CVE-2024-22024", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "33947c86-829d-44af-a7f6-891fc4a3a528", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 83}, "timestamps": {"asserted_at": "2024-02-10T09:26:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-10T09:26:32+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Connect Secure, Policy Secure and ZTA | Class: vpn | Severity: High (CVSS 8.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22024", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22024"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 1, "90d_avg": 1, "product": "Ivanti Connect Secure, Policy Secure and ZTA", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.3, "vulnerability_severity": "High"}}]}
{"uuid": "1b187146-122b-4f88-9847-307b8dbf71d3", "vulnerability": {"vulnId": "CVE-2022-2958", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b187146-122b-4f88-9847-307b8dbf71d3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T18:14:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:14:07+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress BadgeOS plugin | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2958", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2958"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress BadgeOS plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "438e943b-202e-434a-8cb6-6cbf449a8926", "vulnerability": {"vulnId": "CVE-2019-16278", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "438e943b-202e-434a-8cb6-6cbf449a8926", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:05+00:00"}, "scope": {"notes": "Affected: nostromo / nhttpd | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-16278", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16278"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 1, "vendor": "nostromo", "30d_avg": 1, "90d_avg": 2, "product": "nhttpd", "cisa_kev": "yes", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5caa46d5-470a-43b4-931d-1c986fc3e308", "vulnerability": {"vulnId": "CVE-2024-7029", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5caa46d5-470a-43b4-931d-1c986fc3e308", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-09-01T05:08:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-01T05:08:12+00:00"}, "scope": {"notes": "Affected: AVTECH / AVTECH IP camera | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7029", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7029"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "AVTECH", "30d_avg": 1, "90d_avg": 2, "product": "AVTECH IP camera", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "85f25c52-2ca1-4d08-96c4-2eb8a901f358", "vulnerability": {"vulnId": "CVE-2022-0540", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "85f25c52-2ca1-4d08-96c4-2eb8a901f358", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-30T16:33:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-30T16:33:29+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA Seraph | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0540", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0540"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 3, "90d_avg": 3, "product": "JIRA Seraph", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "841bcc9d-6d3a-4db5-9d56-7cb782dcfe63", "vulnerability": {"vulnId": "CVE-2020-14864", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "841bcc9d-6d3a-4db5-9d56-7cb782dcfe63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-10T09:56:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-10T09:56:13+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Business Intelligence (Oracle Fusion Middleware | Class: business-intelligence | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-14864", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14864"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 1, "vendor": "Oracle", "30d_avg": 4, "90d_avg": 3, "product": "Oracle Business Intelligence (Oracle Fusion Middleware", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c555d607-a490-46e6-b81c-27005a7204c3", "vulnerability": {"vulnId": "CVE-2023-27351", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c555d607-a490-46e6-b81c-27005a7204c3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-18T00:07:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-18T00:07:44+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut MF/NG | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27351", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27351"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "PaperCut", "30d_avg": 5, "90d_avg": 4, "product": "PaperCut MF/NG", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "43b9125e-0e40-43a9-b97b-e2ab424b9749", "vulnerability": {"vulnId": "CVE-2022-4063", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "43b9125e-0e40-43a9-b97b-e2ab424b9749", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-19T00:13:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T00:13:22+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress InPost Gallery plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4063", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4063"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress InPost Gallery plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "79b70aa9-0a0a-42ec-80a2-af05e70ab001", "vulnerability": {"vulnId": "CVE-2024-2389", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "79b70aa9-0a0a-42ec-80a2-af05e70ab001", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-04-26T23:06:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-26T23:06:32+00:00"}, "scope": {"notes": "Affected: Progress / Flowmon | Class: network-monitoring | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-2389", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2389"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 2, "product": "Flowmon", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "a52b2fba-9127-40cc-8771-4607bc93d4fe", "vulnerability": {"vulnId": "CVE-2019-19824", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a52b2fba-9127-40cc-8771-4607bc93d4fe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:09+00:00"}, "scope": {"notes": "Affected: Totolink / TOTOLINK Realtek SDK based routers | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-19824", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19824"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 2, "90d_avg": 3, "product": "TOTOLINK Realtek SDK based routers", "cisa_kev": "no", "connections": 14, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "4b9bce54-a27d-4d5f-88c1-4d377f658e1c", "vulnerability": {"vulnId": "CVE-2023-46747", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4b9bce54-a27d-4d5f-88c1-4d377f658e1c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-31T22:47:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-31T22:47:14+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-46747", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46747"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 2, "vendor": "F5", "30d_avg": 6, "90d_avg": 4, "product": "BIG-IP", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "250c5082-c729-49dc-9394-5d2fbdd8465d", "vulnerability": {"vulnId": "CVE-2020-26073", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "250c5082-c729-49dc-9394-5d2fbdd8465d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: Cisco / SD-WAN vManage | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-26073", "url": "https://www.cve.org/CVERecord?id=CVE-2020-26073"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 2, "product": "SD-WAN vManage", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1962e632-5979-4757-ba05-01545a9aee7b", "vulnerability": {"vulnId": "CVE-2023-6909", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1962e632-5979-4757-ba05-01545a9aee7b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-30T18:23:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-30T18:23:58+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6909", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6909"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "MLflow", "30d_avg": 17, "90d_avg": 14, "product": "MLflow", "cisa_kev": "no", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e05b0781-9a36-4da4-83b1-48bd16d1a6b1", "vulnerability": {"vulnId": "CVE-2021-21479", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e05b0781-9a36-4da4-83b1-48bd16d1a6b1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: SAP / SCIMono | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21479", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21479"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SAP", "30d_avg": 0, "90d_avg": 2, "product": "SCIMono", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "c78a4ae6-1067-4147-8915-8d389d901333", "vulnerability": {"vulnId": "CVE-2017-5521", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c78a4ae6-1067-4147-8915-8d389d901333", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2025-05-08T20:35:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-08T20:35:23+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR (multiple routers) | Class: router | Severity: High (CVSS 8.1) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-5521", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5521"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 0, "90d_avg": 1, "product": "NETGEAR (multiple routers)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "3afb1e31-77f7-40b5-b0be-1f61abd506fa", "vulnerability": {"vulnId": "CVE-2021-26294", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3afb1e31-77f7-40b5-b0be-1f61abd506fa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-22T16:32:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:32:07+00:00"}, "scope": {"notes": "Affected: AfterLogic / AfterLogic Aurora/WebMail Pro  | Class: email | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-26294", "url": "https://www.cve.org/CVERecord?id=CVE-2021-26294"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "AfterLogic", "30d_avg": 1, "90d_avg": 2, "product": "AfterLogic Aurora/WebMail Pro ", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "66a048b0-4129-4057-aa6b-15f5296d7c9d", "vulnerability": {"vulnId": "CVE-2024-8877", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "66a048b0-4129-4057-aa6b-15f5296d7c9d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-15T07:12:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-10-15T07:12:30+00:00"}, "scope": {"notes": "Affected: Riello UPS / Netman 2024 | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8877", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8877"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Riello UPS", "30d_avg": 0, "90d_avg": 1, "product": "Netman 2024", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8b232151-ef93-4617-b73e-56dd80112cb2", "vulnerability": {"vulnId": "CVE-2020-11455", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8b232151-ef93-4617-b73e-56dd80112cb2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:16+00:00"}, "scope": {"notes": "Affected: LimeSurvey / LimeSurvey | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11455", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11455"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "LimeSurvey", "30d_avg": 0, "90d_avg": 1, "product": "LimeSurvey", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c9df1890-5785-4beb-96e6-323baec9d87b", "vulnerability": {"vulnId": "CVE-2023-4542", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c9df1890-5785-4beb-96e6-323baec9d87b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-18T08:57:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-18T08:57:51+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DAR-8000-10 | Class: wireless-extender | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4542", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4542"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link DAR-8000-10", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e112c9e5-501f-4bb5-a4d1-6fca878beba1", "vulnerability": {"vulnId": "CVE-2024-32738", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e112c9e5-501f-4bb5-a4d1-6fca878beba1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-22T16:42:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:42:59+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32738", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32738"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CyberPanel", "30d_avg": 0, "90d_avg": 1, "product": "CyberPanel", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e5e4e3f3-fbf0-4cbe-808d-f289f6302a90", "vulnerability": {"vulnId": "CVE-2020-13167", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e5e4e3f3-fbf0-4cbe-808d-f289f6302a90", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:20+00:00"}, "scope": {"notes": "Affected: Netsweeper / Netsweeper | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13167", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13167"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Netsweeper", "30d_avg": 4, "90d_avg": 4, "product": "Netsweeper", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "738fd7ab-e47b-4619-b23d-97c595a57652", "vulnerability": {"vulnId": "CVE-2024-42640", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "738fd7ab-e47b-4619-b23d-97c595a57652", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T06:27:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:27+00:00"}, "scope": {"notes": "Affected: Adones Pitogo / angular-base64-upload | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-42640", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42640"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Adones Pitogo", "30d_avg": 2, "90d_avg": 3, "product": "angular-base64-upload", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "af3cff7d-007f-4cc2-8c9a-baef4bcf7e50", "vulnerability": {"vulnId": "CVE-2017-17215", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "af3cff7d-007f-4cc2-8c9a-baef4bcf7e50", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2022-05-04T10:59:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2022-05-04T10:59:57+00:00"}, "scope": {"notes": "Affected: Huawei / Huawei Home Gateway HG532 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 4761", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-17215", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17215"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1531", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1503, "vendor": "Huawei", "30d_avg": 1736, "90d_avg": 1614, "product": "Huawei Home Gateway HG532", "cisa_kev": "no", "connections": 4761, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "20bdeb5a-acf3-48c1-9860-6a16d84bbf27", "vulnerability": {"vulnId": "CVE-2017-18368", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "20bdeb5a-acf3-48c1-9860-6a16d84bbf27", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:02:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:02:40+00:00"}, "scope": {"notes": "Affected: Zyxel/Billion / ZyXEL P660HN-T1A v1, ZyXEL P660HN-T1A v2, Billion 5200W-T | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 175", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-18368", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18368"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "19", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 25, "vendor": "Zyxel/Billion", "30d_avg": 24, "90d_avg": 13, "product": "ZyXEL P660HN-T1A v1, ZyXEL P660HN-T1A v2, Billion 5200W-T", "cisa_kev": "yes", "connections": 175, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "01159c3b-efe9-4f6a-b1cf-5001b6ca4000", "vulnerability": {"vulnId": "CVE-2015-2051", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "01159c3b-efe9-4f6a-b1cf-5001b6ca4000", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:15:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:15:09+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-645, DAP-1522 revB, DAP-1650 revB, DIR-880L, DIR-865L, DIR-860L revA, DIR-860L revB DIR-815 revB, DIR-300 revB, DIR-600 revB, DIR-645, TEW-751DR, TEW-733GR | Class: router | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 166", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-2051", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2051"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "156", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 150, "vendor": "D-Link", "30d_avg": 140, "90d_avg": 138, "product": "D-Link DIR-645, DAP-1522 revB, DAP-1650 revB, DIR-880L, DIR-865L, DIR-860L revA, DIR-860L revB DIR-815 revB, DIR-300 revB, DIR-600 revB, DIR-645, TEW-751DR, TEW-733GR", "cisa_kev": "yes", "connections": 166, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "afe91dab-7590-47d5-99a2-01af2f2b8a88", "vulnerability": {"vulnId": "CVE-2021-41569", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "afe91dab-7590-47d5-99a2-01af2f2b8a88", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-11-25T22:42:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-25T22:42:16+00:00"}, "scope": {"notes": "Affected: SAS Institute / SAS/IntrNet | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41569", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41569"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SAS Institute", "30d_avg": 0, "90d_avg": 1, "product": "SAS/IntrNet", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "vulnerability": {"vulnId": "CVE-2025-9316", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 69}, "timestamps": {"asserted_at": "2026-01-18T04:40:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T04:40:32+00:00"}, "scope": {"notes": "Affected: N-able / N-able N-central | Class: network-monitoring | Severity: Medium (CVSS 6.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-9316", "url": "https://www.cve.org/CVERecord?id=CVE-2025-9316"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "N-able", "30d_avg": 4, "90d_avg": 4, "product": "N-able N-central", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.9, "vulnerability_severity": "Medium"}}]}
{"uuid": "bf225678-b779-46a1-a7e4-e24532ceb850", "vulnerability": {"vulnId": "CVE-2023-35078", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bf225678-b779-46a1-a7e4-e24532ceb850", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-13T18:56:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T18:56:58+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35078", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35078"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 4, "vendor": "Ivanti", "30d_avg": 8, "90d_avg": 35, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "6a9dccc4-dc5e-4b70-ac97-8d35c015052a", "vulnerability": {"vulnId": "CVE-2022-2486", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6a9dccc4-dc5e-4b70-ac97-8d35c015052a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN535K2 and WN535K3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2486", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2486"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "WAVLINK", "30d_avg": 1, "90d_avg": 2, "product": "WAVLINK WN535K2 and WN535K3", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9e50c3d4-8dc8-4fb3-a5b7-b53f74c43479", "vulnerability": {"vulnId": "CVE-2023-32235", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9e50c3d4-8dc8-4fb3-a5b7-b53f74c43479", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:49+00:00"}, "scope": {"notes": "Affected: Ghost / Ghost | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-32235", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32235"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Ghost", "30d_avg": 5, "90d_avg": 4, "product": "Ghost", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "415cf380-bed2-47ba-8f7b-2c08be118fd6", "vulnerability": {"vulnId": "CVE-2021-20837", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "415cf380-bed2-47ba-8f7b-2c08be118fd6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:47+00:00"}, "scope": {"notes": "Affected: Six Apart (Movable Type) / Movable Type | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20837", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20837"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Six Apart (Movable Type)", "30d_avg": 1, "90d_avg": 2, "product": "Movable Type", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f8f9b7ee-548d-4add-9eb8-eecfd721ed94", "vulnerability": {"vulnId": "CVE-2019-12780", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8f9b7ee-548d-4add-9eb8-eecfd721ed94", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:09:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:09:23+00:00"}, "scope": {"notes": "Affected: Belkin / Wemo | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 107", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12780", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12780"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "99", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 143, "vendor": "Belkin", "30d_avg": 124, "90d_avg": 128, "product": "Wemo", "cisa_kev": "no", "connections": 107, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "98a98e06-fb41-4ffc-8c10-093709dadaf7", "vulnerability": {"vulnId": "CVE-2025-4427", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "98a98e06-fb41-4ffc-8c10-093709dadaf7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-05-15T18:14:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-15T18:14:12+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4427", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4427"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 2, "vendor": "Ivanti", "30d_avg": 11, "90d_avg": 5, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "20caf936-f144-40e0-8a8b-3190a02e550f", "vulnerability": {"vulnId": "CVE-2018-13379", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "20caf936-f144-40e0-8a8b-3190a02e550f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:00:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:00+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 41654", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13379"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "41", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 179, "vendor": "Fortinet", "30d_avg": 59, "90d_avg": 46, "product": "FortiOS", "cisa_kev": "yes", "connections": 41654, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a5146cbd-4fec-4193-a0db-6fa98551e154", "vulnerability": {"vulnId": "CVE-2019-9670", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a5146cbd-4fec-4193-a0db-6fa98551e154", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:03:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:03:21+00:00"}, "scope": {"notes": "Affected: Synacor / Zimbra Collaboration Suite | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9670", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9670"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "Synacor", "30d_avg": 3, "90d_avg": 6, "product": "Zimbra Collaboration Suite", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ae02afb4-3bf9-42e1-a93c-1a1ec6a1373f", "vulnerability": {"vulnId": "CVE-2024-0012", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ae02afb4-3bf9-42e1-a93c-1a1ec6a1373f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-11-19T11:11:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-19T11:11:53+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / PAN-OS | Class: firewall | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0012", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0012"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 3, "vendor": "Palo Alto Networks", "30d_avg": 10, "90d_avg": 7, "product": "PAN-OS", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "601ca581-8558-4d57-ad7c-58bb8445099a", "vulnerability": {"vulnId": "CVE-2022-48164", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "601ca581-8558-4d57-ad7c-58bb8445099a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-05-12T03:53:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-12T03:53:49+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WL-WN533A8 | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-48164", "url": "https://www.cve.org/CVERecord?id=CVE-2022-48164"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "WAVLINK", "30d_avg": 2, "90d_avg": 4, "product": "WAVLINK WL-WN533A8", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a4031c72-2329-497b-93ba-9970efe6b0f3", "vulnerability": {"vulnId": "CVE-2025-0108", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a4031c72-2329-497b-93ba-9970efe6b0f3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-02-13T21:18:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-13T21:18:14+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / PAN-OS | Class: firewall | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-0108", "url": "https://www.cve.org/CVERecord?id=CVE-2025-0108"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 7, "vendor": "Palo Alto Networks", "30d_avg": 11, "90d_avg": 11, "product": "PAN-OS", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "bb5c8e33-013f-40c6-bed4-a654f529caa9", "vulnerability": {"vulnId": "CVE-2022-47945", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bb5c8e33-013f-40c6-bed4-a654f529caa9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-11T10:38:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-11T10:38:34+00:00"}, "scope": {"notes": "Affected: TopThink / ThinkPHP | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-47945", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47945"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "TopThink", "30d_avg": 2, "90d_avg": 3, "product": "ThinkPHP", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "baf44e82-de07-4749-ae2b-3b12bf7c1f92", "vulnerability": {"vulnId": "CVE-2021-26855", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "baf44e82-de07-4749-ae2b-3b12bf7c1f92", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:08:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:08:44+00:00"}, "scope": {"notes": "Affected: Microsoft / Exchange | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-26855", "url": "https://www.cve.org/CVERecord?id=CVE-2021-26855"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 11, "vendor": "Microsoft", "30d_avg": 11, "90d_avg": 9, "product": "Exchange", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ee6727dd-404d-4ec8-b794-598ff289429c", "vulnerability": {"vulnId": "CVE-2018-12296", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ee6727dd-404d-4ec8-b794-598ff289429c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T20:53:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:25+00:00"}, "scope": {"notes": "Affected: Seagate / Seagate NAS OS | Class: nas | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-12296", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12296"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "Seagate", "30d_avg": 2, "90d_avg": 3, "product": "Seagate NAS OS", "cisa_kev": "no", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "30ccfd95-ed82-4f0b-bd08-0abe99b3acc6", "vulnerability": {"vulnId": "CVE-2018-1273", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "30ccfd95-ed82-4f0b-bd08-0abe99b3acc6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:34:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:34:43+00:00"}, "scope": {"notes": "Affected: Spring / Spring Data Commons | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-1273", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1273"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 2, "vendor": "Spring", "30d_avg": 5, "90d_avg": 4, "product": "Spring Data Commons", "cisa_kev": "yes", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c62cef39-0605-4e25-9aa7-20538a7fd9d4", "vulnerability": {"vulnId": "CVE-2023-4966", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c62cef39-0605-4e25-9aa7-20538a7fd9d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-25T05:38:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-25T05:38:24+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ADC and Citrix Gateway | Class: app-delivery-controller | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4966", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4966"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 5, "vendor": "Citrix", "30d_avg": 6, "90d_avg": 18, "product": "Citrix ADC and Citrix Gateway", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5aea00dc-27dc-494b-8c7c-52c236edc776", "vulnerability": {"vulnId": "CVE-2020-11738", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5aea00dc-27dc-494b-8c7c-52c236edc776", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:17+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Duplicator plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11738", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11738"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 7, "90d_avg": 5, "product": "Wordpress Duplicator plugin", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "64425f53-a1f2-478d-919f-5a45c15efa36", "vulnerability": {"vulnId": "CVE-2019-17506", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "64425f53-a1f2-478d-919f-5a45c15efa36", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:07+00:00"}, "scope": {"notes": "Affected: D-Link / DIR-868L/DIR-817LW | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 25", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-17506", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17506"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 2, "90d_avg": 4, "product": "DIR-868L/DIR-817LW", "cisa_kev": "no", "connections": 25, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5c29127d-237f-4223-9907-d09841d678c6", "vulnerability": {"vulnId": "CVE-2025-53118", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5c29127d-237f-4223-9907-d09841d678c6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-10T11:24:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-10T11:24:04+00:00"}, "scope": {"notes": "Affected: Securden / Securden Unified PAM | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-53118", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53118"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Securden", "30d_avg": 5, "90d_avg": 4, "product": "Securden Unified PAM", "cisa_kev": "no", "connections": 51, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6236f745-7a3a-4ef4-a711-2354d74c76db", "vulnerability": {"vulnId": "CVE-2024-20767", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6236f745-7a3a-4ef4-a711-2354d74c76db", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2024-04-11T20:09:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-11T20:09:49+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-20767", "url": "https://www.cve.org/CVERecord?id=CVE-2024-20767"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 4, "90d_avg": 3, "product": "ColdFusion", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "ed7da7cf-2388-4b73-8563-d24682e4449c", "vulnerability": {"vulnId": "CVE-2018-1335", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ed7da7cf-2388-4b73-8563-d24682e4449c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-10-14T20:53:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:27+00:00"}, "scope": {"notes": "Affected: Apache / Tika | Class: other-software | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 49", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-1335", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1335"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "Tika", "cisa_kev": "no", "connections": 49, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "73733f27-e31d-449a-86e5-7398a18770d3", "vulnerability": {"vulnId": "CVE-2023-36144", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "73733f27-e31d-449a-86e5-7398a18770d3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-05-09T04:42:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-09T04:42:36+00:00"}, "scope": {"notes": "Affected: Intelbras / Intelbras Switch SG 2404 MR | Class: router | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-36144", "url": "https://www.cve.org/CVERecord?id=CVE-2023-36144"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Intelbras", "30d_avg": 1, "90d_avg": 2, "product": "Intelbras Switch SG 2404 MR", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "60ec08e2-667c-4cb0-b78c-ac4058db2559", "vulnerability": {"vulnId": "CVE-2026-21643", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "60ec08e2-667c-4cb0-b78c-ac4058db2559", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-04T23:51:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-04T23:51:07+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiClientEMS | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-21643", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21643"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Fortinet", "30d_avg": 5, "90d_avg": 5, "product": "FortiClientEMS", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5a6b960b-12b8-4022-bf7a-5f61099ce254", "vulnerability": {"vulnId": "CVE-2018-12031", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5a6b960b-12b8-4022-bf7a-5f61099ce254", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T20:53:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:24+00:00"}, "scope": {"notes": "Affected: Eaton / Intelligent Power Manager | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-12031", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12031"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "Eaton", "30d_avg": 6, "90d_avg": 4, "product": "Intelligent Power Manager", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a14a4935-c529-4d07-882d-841d8af370cd", "vulnerability": {"vulnId": "CVE-2022-29081", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a14a4935-c529-4d07-882d-841d8af370cd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T18:14:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-18T18:14:14+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine Access Manager Plus, Password Manager Pro, PAM360 | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29081", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29081"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 2, "product": "ManageEngine Access Manager Plus, Password Manager Pro, PAM360", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a3ea6300-98b8-4a05-8c19-a268e2e54bfa", "vulnerability": {"vulnId": "CVE-2019-2616", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a3ea6300-98b8-4a05-8c19-a268e2e54bfa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-14T14:56:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:10+00:00"}, "scope": {"notes": "Affected: Oracle / BI Publisher (Oracle Fusion Middleware) | Class: other-software | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-2616", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2616"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 1, "90d_avg": 2, "product": "BI Publisher (Oracle Fusion Middleware)", "cisa_kev": "yes", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "1ef9b00c-6d1b-4f86-8f9a-901d4a90d0e7", "vulnerability": {"vulnId": "CVE-2019-20074", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1ef9b00c-6d1b-4f86-8f9a-901d4a90d0e7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-05-09T04:40:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-09T04:40:34+00:00"}, "scope": {"notes": "Affected: Netis / Netis DL4323 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-20074", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20074"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Netis", "30d_avg": 1, "90d_avg": 0, "product": "Netis DL4323", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "0932492b-1d98-4a1b-8c31-b06f4f83d86b", "vulnerability": {"vulnId": "CVE-2022-31847", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0932492b-1d98-4a1b-8c31-b06f4f83d86b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:18+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN579X3 | Class: wireless-extender | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31847", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31847"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "WAVLINK", "30d_avg": 1, "90d_avg": 5, "product": "WAVLINK WN579X3", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e620a590-520f-4d3b-a72a-9c7d96e511a9", "vulnerability": {"vulnId": "CVE-2024-22319", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e620a590-520f-4d3b-a72a-9c7d96e511a9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-17T20:10:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-17T20:10:12+00:00"}, "scope": {"notes": "Affected: IBM / IBM Operational Decision Manager | Class: business-intelligence | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22319", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22319"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 0, "vendor": "IBM", "30d_avg": 1, "90d_avg": 2, "product": "IBM Operational Decision Manager", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ef624220-d46c-4760-91c8-5bbbe0cd5eaf", "vulnerability": {"vulnId": "CVE-2024-7339", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ef624220-d46c-4760-91c8-5bbbe0cd5eaf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2024-09-14T10:47:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-14T10:47:15+00:00"}, "scope": {"notes": "Affected: TVT/Provision-ISR / Multiple DVR models | Class: video-system | Severity: Medium (CVSS 5.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7339", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7339"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "TVT/Provision-ISR", "30d_avg": 2, "90d_avg": 1, "product": "Multiple DVR models", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "b7f5174c-1aa6-42bd-b086-198ca851d6b0", "vulnerability": {"vulnId": "CVE-2019-12989", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b7f5174c-1aa6-42bd-b086-198ca851d6b0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-31T00:06:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-31T00:06:09+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12989", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12989"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "Citrix", "30d_avg": 1, "90d_avg": 2, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "629ff7e3-8409-4a73-888a-2955d9b73451", "vulnerability": {"vulnId": "CVE-2021-44515", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "629ff7e3-8409-4a73-888a-2955d9b73451", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-24T04:43:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-24T04:43:07+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine Desktop Central | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-44515", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44515"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 2, "90d_avg": 2, "product": "ManageEngine Desktop Central", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "61f8b6c7-8340-419e-a6a3-4149486af82a", "vulnerability": {"vulnId": "CVE-2021-47795", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "61f8b6c7-8340-419e-a6a3-4149486af82a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-01-25T11:38:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-25T11:38:11+00:00"}, "scope": {"notes": "Affected: GeoVision / GeoVision GeoWebServer | Class: embedded-system | Severity: High (CVSS 8.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-47795", "url": "https://www.cve.org/CVERecord?id=CVE-2021-47795"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "GeoVision", "30d_avg": 1, "90d_avg": 0, "product": "GeoVision GeoWebServer", "cisa_kev": "no", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}]}
{"uuid": "9be2e414-4d33-4a6c-afc9-50ad8392de68", "vulnerability": {"vulnId": "CVE-2019-19781", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9be2e414-4d33-4a6c-afc9-50ad8392de68", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:09+00:00"}, "scope": {"notes": "Affected: Citrix / Application Delivery Controller | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-19781", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19781"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 6, "vendor": "Citrix", "30d_avg": 5, "90d_avg": 6, "product": "Application Delivery Controller", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d6a017fa-7ad5-4257-8aff-787dacc5f839", "vulnerability": {"vulnId": "CVE-2011-3600", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d6a017fa-7ad5-4257-8aff-787dacc5f839", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:00+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2011-3600", "url": "https://www.cve.org/CVERecord?id=CVE-2011-3600"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 2, "90d_avg": 3, "product": "OFBiz", "cisa_kev": "no", "connections": 33, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9d51285f-1b0b-4fc9-bc18-11160e7bc5cf", "vulnerability": {"vulnId": "CVE-2024-4577", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9d51285f-1b0b-4fc9-bc18-11160e7bc5cf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-06-07T13:40:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-07T13:40:23+00:00"}, "scope": {"notes": "Affected: PHP Foundation / PHP (PHP-CGI) | Class: web-app-framework | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4577", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4577"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "PHP Foundation", "30d_avg": 0, "90d_avg": 0, "product": "PHP (PHP-CGI)", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "3bfe4811-8f95-4cbb-869a-cb17f1def450", "vulnerability": {"vulnId": "CVE-2020-15568", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3bfe4811-8f95-4cbb-869a-cb17f1def450", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:54:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:54:00+00:00"}, "scope": {"notes": "Affected: TerraMaster / TOS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15568", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15568"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "TerraMaster", "30d_avg": 4, "90d_avg": 4, "product": "TOS", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "aeba639c-d741-4091-b8d8-2f4a76eb4a1a", "vulnerability": {"vulnId": "CVE-2019-2725", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aeba639c-d741-4091-b8d8-2f4a76eb4a1a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T06:00:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T06:00:24+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-2725", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2725"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 2, "vendor": "Oracle", "30d_avg": 10, "90d_avg": 8, "product": "Oracle Weblogic Server", "cisa_kev": "yes", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a92a6466-e9cb-43b2-a5d6-880d3b80f0ad", "vulnerability": {"vulnId": "CVE-2021-35464", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a92a6466-e9cb-43b2-a5d6-880d3b80f0ad", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:00+00:00"}, "scope": {"notes": "Affected: ForgeRock / ForgeRock Access Manager | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35464", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35464"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "ForgeRock", "30d_avg": 1, "90d_avg": 2, "product": "ForgeRock Access Manager", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ba9d4f42-bc6d-4132-94c2-e06d73d1c529", "vulnerability": {"vulnId": "CVE-2020-19625", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ba9d4f42-bc6d-4132-94c2-e06d73d1c529", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:54:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:54:29+00:00"}, "scope": {"notes": "Affected: oria / gridx | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-19625", "url": "https://www.cve.org/CVERecord?id=CVE-2020-19625"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "oria", "30d_avg": 0, "90d_avg": 1, "product": "gridx", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7441c7ba-7b99-42ed-8d92-7b95e8167a7c", "vulnerability": {"vulnId": "CVE-2018-17431", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7441c7ba-7b99-42ed-8d92-7b95e8167a7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-19T14:52:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-19T14:52:02+00:00"}, "scope": {"notes": "Affected: Comodo / Comodo UTM Firewall | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 22", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-17431", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17431"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Comodo", "30d_avg": 4, "90d_avg": 3, "product": "Comodo UTM Firewall", "cisa_kev": "no", "connections": 22, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ff1d519-076a-4c98-beb0-2ed1e7764f23", "vulnerability": {"vulnId": "CVE-2019-1821", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ff1d519-076a-4c98-beb0-2ed1e7764f23", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:08+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-1821", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1821"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Cisco", "30d_avg": 5, "90d_avg": 4, "product": "Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN)", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2f36afc1-8154-467e-99cb-20cd6db3cf2d", "vulnerability": {"vulnId": "CVE-2023-34133", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2f36afc1-8154-467e-99cb-20cd6db3cf2d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:50+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicWall GMS and Analytics | Class: security-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34133", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34133"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "SonicWall", "30d_avg": 8, "90d_avg": 7, "product": "SonicWall GMS and Analytics", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "514198d4-61a0-48a8-8ea2-122c00a886ab", "vulnerability": {"vulnId": "CVE-2018-19276", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "514198d4-61a0-48a8-8ea2-122c00a886ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-05-28T21:39:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-28T21:39:18+00:00"}, "scope": {"notes": "Affected: OpenMRS / OpenMRS | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-19276", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19276"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "OpenMRS", "30d_avg": 4, "90d_avg": 3, "product": "OpenMRS", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7f2d53d1-cffd-4fea-97a2-522c695d0f41", "vulnerability": {"vulnId": "CVE-2020-27986", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f2d53d1-cffd-4fea-97a2-522c695d0f41", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: SonarQube / SonarQube | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-27986", "url": "https://www.cve.org/CVERecord?id=CVE-2020-27986"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "SonarQube", "30d_avg": 1, "90d_avg": 2, "product": "SonarQube", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8cc921c0-d32a-490e-9786-f6883d6f245d", "vulnerability": {"vulnId": "CVE-2019-5128", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8cc921c0-d32a-490e-9786-f6883d6f245d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: YouPHPTube / YouPHPTube Encoder | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-5128", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5128"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "YouPHPTube", "30d_avg": 5, "90d_avg": 5, "product": "YouPHPTube Encoder", "cisa_kev": "no", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "46225cf0-d188-4102-9bf6-696a941c9a54", "vulnerability": {"vulnId": "CVE-2019-9733", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "46225cf0-d188-4102-9bf6-696a941c9a54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:15+00:00"}, "scope": {"notes": "Affected: JFrog / Artifactory | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9733", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9733"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "JFrog", "30d_avg": 1, "90d_avg": 2, "product": "Artifactory", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7f04a178-b867-4125-b765-be498e8e4b55", "vulnerability": {"vulnId": "CVE-2018-9995", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f04a178-b867-4125-b765-be498e8e4b55", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:00:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:00+00:00"}, "scope": {"notes": "Affected: TBK / DVR4104/DVR4216 and multiple re-branded versions | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-9995", "url": "https://www.cve.org/CVERecord?id=CVE-2018-9995"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "TBK", "30d_avg": 1, "90d_avg": 2, "product": "DVR4104/DVR4216 and multiple re-branded versions", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c72a4b1b-10de-44f0-aa4d-646a07523c13", "vulnerability": {"vulnId": "CVE-2020-10189", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c72a4b1b-10de-44f0-aa4d-646a07523c13", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-21T12:36:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-21T12:36:01+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine Desktop Central (now Engine Central) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10189", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10189"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 2, "product": "ManageEngine Desktop Central (now Engine Central)", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "049e9872-c9f0-4fba-92c5-f274855150f0", "vulnerability": {"vulnId": "CVE-2021-4462", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "049e9872-c9f0-4fba-92c5-f274855150f0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-15T16:44:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-15T16:44:31+00:00"}, "scope": {"notes": "Affected: skittles / Simple Employee Records System 1.0 | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 23", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-4462", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4462"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "skittles", "30d_avg": 2, "90d_avg": 5, "product": "Simple Employee Records System 1.0", "cisa_kev": "no", "connections": 23, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a9ecd376-b709-455b-b56b-a30a8b6569e9", "vulnerability": {"vulnId": "CVE-2019-15642", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a9ecd376-b709-455b-b56b-a30a8b6569e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-01-16T02:49:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-16T02:49:11+00:00"}, "scope": {"notes": "Affected: Webmin / Webmin | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-15642", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15642"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Webmin", "30d_avg": 4, "90d_avg": 3, "product": "Webmin", "cisa_kev": "no", "connections": 13, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "25789e8f-9bec-4918-a194-ec7c5f578b8c", "vulnerability": {"vulnId": "CVE-2021-26086", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "25789e8f-9bec-4918-a194-ec7c5f578b8c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-26T23:27:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-26T23:27:19+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 25", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-26086", "url": "https://www.cve.org/CVERecord?id=CVE-2021-26086"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 0, "product": "JIRA", "cisa_kev": "yes", "connections": 25, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "a9740d4c-8afe-40b2-b3be-973ac8aac049", "vulnerability": {"vulnId": "CVE-2020-7980", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a9740d4c-8afe-40b2-b3be-973ac8aac049", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:40+00:00"}, "scope": {"notes": "Affected: Intellian / Intellian Aptus Web | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-7980", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7980"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Intellian", "30d_avg": 1, "90d_avg": 2, "product": "Intellian Aptus Web", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ae65ba04-b0d4-43d7-a4ae-d3483856f673", "vulnerability": {"vulnId": "CVE-2019-25141", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ae65ba04-b0d4-43d7-a4ae-d3483856f673", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:28:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:28:38+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Easy WP SMTP plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-25141", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25141"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Easy WP SMTP plugin", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3ae79da3-7594-4044-b515-8e4980593e65", "vulnerability": {"vulnId": "CVE-2016-10372", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3ae79da3-7594-4044-b515-8e4980593e65", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:01:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:01:26+00:00"}, "scope": {"notes": "Affected: Zyxel / Eir D1000 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 328", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-10372", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10372"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "275", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 284, "vendor": "Zyxel", "30d_avg": 272, "90d_avg": 264, "product": "Eir D1000", "cisa_kev": "no", "connections": 328, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3da5c58b-827e-4a21-97a9-5b0a405736b6", "vulnerability": {"vulnId": "CVE-2022-40022", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3da5c58b-827e-4a21-97a9-5b0a405736b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:38+00:00"}, "scope": {"notes": "Affected: Microchip Technology (Microsemi) / SyncServer | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40022", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40022"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Microchip Technology (Microsemi)", "30d_avg": 1, "90d_avg": 2, "product": "SyncServer", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "23c89e56-a29c-4938-826d-5ff68a5fed62", "vulnerability": {"vulnId": "CVE-2018-6530", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "23c89e56-a29c-4938-826d-5ff68a5fed62", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-24T07:01:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-24T07:01:19+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link multiple routers | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 21", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-6530", "url": "https://www.cve.org/CVERecord?id=CVE-2018-6530"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "D-Link", "30d_avg": 4, "90d_avg": 4, "product": "D-Link multiple routers", "cisa_kev": "yes", "connections": 21, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "36e24aa2-07e7-451d-90f5-968b387cebf9", "vulnerability": {"vulnId": "CVE-2026-10520", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "36e24aa2-07e7-451d-90f5-968b387cebf9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-10T17:11:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-06-10T17:11:12+00:00"}, "scope": {"notes": "Affected: Ivanti / Sentry | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-10520", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 16, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 2, "product": "Sentry", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "8d39720f-2add-45dc-ab6d-209150d36d16", "vulnerability": {"vulnId": "CVE-2021-27855", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8d39720f-2add-45dc-ab6d-209150d36d16", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-22T11:15:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-22T11:15:43+00:00"}, "scope": {"notes": "Affected: FatPipe / FatPipe WARP/IPVPN/MPVPN  | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27855", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27855"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "FatPipe", "30d_avg": 1, "90d_avg": 2, "product": "FatPipe WARP/IPVPN/MPVPN ", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ca88a407-23d6-4152-ad01-243449672dea", "vulnerability": {"vulnId": "CVE-2022-29007", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ca88a407-23d6-4152-ad01-243449672dea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:28+00:00"}, "scope": {"notes": "Affected: Dairy Farm Shop Management System / Dairy Farm Shop Management System v1.0 | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29007", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29007"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Dairy Farm Shop Management System", "30d_avg": 4, "90d_avg": 3, "product": "Dairy Farm Shop Management System v1.0", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "df731af8-7b69-40a3-aa5e-a6ec02eb4895", "vulnerability": {"vulnId": "CVE-2022-38130", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "df731af8-7b69-40a3-aa5e-a6ec02eb4895", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-21T13:26:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-21T13:26:29+00:00"}, "scope": {"notes": "Affected: Keysight Technologies / Sensor Management Server | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-38130", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38130"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Keysight Technologies", "30d_avg": 1, "90d_avg": 2, "product": "Sensor Management Server", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "35ab06c4-76d0-493b-b393-1d0f2802cc02", "vulnerability": {"vulnId": "CVE-2020-8191", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "35ab06c4-76d0-493b-b393-1d0f2802cc02", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-04-06T16:31:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-06T16:31:49+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | Class: app-delivery-controller | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8191", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8191"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 2, "vendor": "Citrix", "30d_avg": 3, "90d_avg": 2, "product": "Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "df2b080d-b707-4e32-b843-89da648092ed", "vulnerability": {"vulnId": "CVE-2020-3452", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "df2b080d-b707-4e32-b843-89da648092ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ASA and Cisco Firepower Threat Defense | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-3452", "url": "https://www.cve.org/CVERecord?id=CVE-2020-3452"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 262, "vendor": "Cisco", "30d_avg": 77, "90d_avg": 52, "product": "Cisco ASA and Cisco Firepower Threat Defense", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "24f42e85-57e1-4089-b859-54a8274ed3d6", "vulnerability": {"vulnId": "CVE-2025-68645", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "24f42e85-57e1-4089-b859-54a8274ed3d6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-14T19:46:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-14T19:46:49+00:00"}, "scope": {"notes": "Affected: Zimbra / Zimbra Collaboration Suite | Class: email | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-68645", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68645"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "Zimbra", "30d_avg": 3, "90d_avg": 2, "product": "Zimbra Collaboration Suite", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "634e4df2-7b4d-4428-ba3b-01bf8d7b598f", "vulnerability": {"vulnId": "CVE-2021-40870", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "634e4df2-7b4d-4428-ba3b-01bf8d7b598f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:35:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:35:29+00:00"}, "scope": {"notes": "Affected: Aviatrix / Aviatrix Controller | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-40870", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40870"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Aviatrix", "30d_avg": 4, "90d_avg": 3, "product": "Aviatrix Controller", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d46b2ac5-95c5-42a7-8050-813464983387", "vulnerability": {"vulnId": "CVE-2024-4358", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d46b2ac5-95c5-42a7-8050-813464983387", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-07T11:19:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-07T11:19:49+00:00"}, "scope": {"notes": "Affected: Progress / Telerik Report Server | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4358", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4358"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Progress", "30d_avg": 4, "90d_avg": 3, "product": "Telerik Report Server", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fe42b613-c532-4d17-866c-eb9ce0256b5e", "vulnerability": {"vulnId": "CVE-2023-26801", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fe42b613-c532-4d17-866c-eb9ce0256b5e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:00:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:48+00:00"}, "scope": {"notes": "Affected: LB-LINK / LB-LINK BL-AC1900_2.0, LB-LINK BL-WR9000, LB-LINK BL-X26, LB-LINK BL-LTE300 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 1650", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26801", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26801"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "LB-LINK", "30d_avg": 1, "90d_avg": 2, "product": "LB-LINK BL-AC1900_2.0, LB-LINK BL-WR9000, LB-LINK BL-X26, LB-LINK BL-LTE300", "cisa_kev": "no", "connections": 1650, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "vulnerability": {"vulnId": "CVE-2022-22965", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:27+00:00"}, "scope": {"notes": "Affected: Spring / Spring Framework | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22965", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 3, "vendor": "Spring", "30d_avg": 5, "90d_avg": 4, "product": "Spring Framework", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4814e862-4348-4dbe-baf9-989e731acc9e", "vulnerability": {"vulnId": "CVE-2023-5222", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4814e862-4348-4dbe-baf9-989e731acc9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-16T09:45:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-16T09:45:22+00:00"}, "scope": {"notes": "Affected: Viessmann / Vitogate 300 BN/MB | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5222", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5222"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Viessmann", "30d_avg": 5, "90d_avg": 4, "product": "Vitogate 300 BN/MB", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3b4b9cb4-bdcf-4de3-b296-e8ac215d64a5", "vulnerability": {"vulnId": "CVE-2022-4117", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3b4b9cb4-bdcf-4de3-b296-e8ac215d64a5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress IWS - Geo Form Fields plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4117", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4117"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress IWS - Geo Form Fields plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "387cffe4-1674-4742-9b9b-919c9e44fe65", "vulnerability": {"vulnId": "CVE-2023-29298", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "387cffe4-1674-4742-9b9b-919c9e44fe65", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:48+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-29298", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29298"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 1, "90d_avg": 3, "product": "ColdFusion", "cisa_kev": "yes", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2b4ba6f6-6197-4455-a89e-b6e87874415f", "vulnerability": {"vulnId": "CVE-2023-45878", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2b4ba6f6-6197-4455-a89e-b6e87874415f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-05-19T13:16:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-19T13:16:32+00:00"}, "scope": {"notes": "Affected: Gibbon / Gibbon | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-45878", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45878"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Gibbon", "30d_avg": 1, "90d_avg": 2, "product": "Gibbon", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ff01f769-be8f-4564-8b0e-f0d115f640fd", "vulnerability": {"vulnId": "CVE-2021-24285", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff01f769-be8f-4564-8b0e-f0d115f640fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:51+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Car Seller - Auto Classifieds Script plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24285", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24285"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Car Seller - Auto Classifieds Script plugin", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "81083303-6b5a-4c50-8ccc-59da5b05bd46", "vulnerability": {"vulnId": "CVE-2023-43208", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "81083303-6b5a-4c50-8ccc-59da5b05bd46", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2024-05-25T19:12:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-05-25T19:12:55+00:00"}, "scope": {"notes": "Affected: NextGen Healthcare / Mirth Connect | Class: other-software | Severity: Critical (CVSS 9.9) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-43208", "url": "https://www.cve.org/CVERecord?id=CVE-2023-43208"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "NextGen Healthcare", "30d_avg": 5, "90d_avg": 4, "product": "Mirth Connect", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "e9978c5b-388b-468a-ba45-f0209deab56b", "vulnerability": {"vulnId": "CVE-2024-4443", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e9978c5b-388b-468a-ba45-f0209deab56b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-18T23:39:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-18T23:39:27+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Business Directory Plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4443", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4443"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress Business Directory Plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "117b75d8-d5b9-4c17-b4c7-fc803d85f3a7", "vulnerability": {"vulnId": "CVE-2023-50968", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "117b75d8-d5b9-4c17-b4c7-fc803d85f3a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-16T03:05:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-16T03:05:00+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 35", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-50968", "url": "https://www.cve.org/CVERecord?id=CVE-2023-50968"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 4, "90d_avg": 3, "product": "OFBiz", "cisa_kev": "no", "connections": 35, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "866d12d9-49bf-4aad-909e-98f93e027718", "vulnerability": {"vulnId": "CVE-2023-22518", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "866d12d9-49bf-4aad-909e-98f93e027718", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-03T23:19:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-03T23:19:30+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22518", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22518"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 8, "product": "Confluence", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6db6844a-6f0f-428f-b548-ad15f96c6e07", "vulnerability": {"vulnId": "CVE-2023-22478", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6db6844a-6f0f-428f-b548-ad15f96c6e07", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:43+00:00"}, "scope": {"notes": "Affected: FIT2CLOUD / KubePi | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22478", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22478"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "FIT2CLOUD", "30d_avg": 1, "90d_avg": 2, "product": "KubePi", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5d30223a-ed8d-4c31-9d5b-c8921b252ff7", "vulnerability": {"vulnId": "CVE-2022-1768", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5d30223a-ed8d-4c31-9d5b-c8921b252ff7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:28+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress RSVPMaker plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1768", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1768"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress RSVPMaker plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "b8b8d16f-3c9b-475d-a4c6-ede2d23076ad", "vulnerability": {"vulnId": "CVE-2021-27931", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b8b8d16f-3c9b-475d-a4c6-ede2d23076ad", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T14:56:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:55+00:00"}, "scope": {"notes": "Affected: Lumis / LumisXP | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27931", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27931"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Lumis", "30d_avg": 1, "90d_avg": 2, "product": "LumisXP", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "49a6ad62-9105-4b71-b276-11ef573d0b16", "vulnerability": {"vulnId": "CVE-2017-5638", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "49a6ad62-9105-4b71-b276-11ef573d0b16", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-13T17:49:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T17:49:40+00:00"}, "scope": {"notes": "Affected: Apache / Struts | Class: web-app-framework | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-5638", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5638"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 0, "product": "Struts", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "8dc3c7a8-29bb-4208-a50a-1f4b97b6b7e8", "vulnerability": {"vulnId": "CVE-2022-28005", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8dc3c7a8-29bb-4208-a50a-1f4b97b6b7e8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-19T15:51:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T15:51:57+00:00"}, "scope": {"notes": "Affected: 3CX / 3CX Phone System Management Console | Class: ip-pbx | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28005", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28005"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "3CX", "30d_avg": 0, "90d_avg": 1, "product": "3CX Phone System Management Console", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d490d8fa-472c-4229-adc4-28ea9a684533", "vulnerability": {"vulnId": "CVE-2022-3481", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d490d8fa-472c-4229-adc4-28ea9a684533", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:58:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-21T01:58:03+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WooCommerce Dropshipping plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-3481", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3481"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress WooCommerce Dropshipping plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8d27098f-f845-4b5b-9aa1-04a6c1670bfc", "vulnerability": {"vulnId": "CVE-2024-3273", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8d27098f-f845-4b5b-9aa1-04a6c1670bfc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-09T16:13:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-09T16:13:27+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L | Class: nas | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-3273", "url": "https://www.cve.org/CVERecord?id=CVE-2024-3273"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "dc480d24-56c1-4b11-9bbc-0412ea3ccf24", "vulnerability": {"vulnId": "CVE-2021-22707", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dc480d24-56c1-4b11-9bbc-0412ea3ccf24", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-14T00:45:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-14T00:45:23+00:00"}, "scope": {"notes": "Affected: Schneider Electric / EVlink City, Parking and Smart Wallbox | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22707", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22707"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Schneider Electric", "30d_avg": 1, "90d_avg": 2, "product": "EVlink City, Parking and Smart Wallbox", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d57072a5-25c7-4530-a50b-a23eae18dc44", "vulnerability": {"vulnId": "CVE-2023-43795", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d57072a5-25c7-4530-a50b-a23eae18dc44", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-22T15:24:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-22T15:24:54+00:00"}, "scope": {"notes": "Affected: GeoServer / GeoServer | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-43795", "url": "https://www.cve.org/CVERecord?id=CVE-2023-43795"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GeoServer", "30d_avg": 2, "90d_avg": 3, "product": "GeoServer", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "75bb472c-dc99-43b9-9a95-4d7ad0432fd4", "vulnerability": {"vulnId": "CVE-2021-33690", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "75bb472c-dc99-43b9-9a95-4d7ad0432fd4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2023-12-10T12:50:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-10T12:50:04+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver Development Infrastructure | Class: other-software | Severity: Critical (CVSS 9.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-33690", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33690"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SAP", "30d_avg": 1, "90d_avg": 2, "product": "NetWeaver Development Infrastructure", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "eb6772cb-120c-49f7-9ce4-07f9598ed6df", "vulnerability": {"vulnId": "CVE-2023-5074", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eb6772cb-120c-49f7-9ce4-07f9598ed6df", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-25T22:35:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-25T22:35:32+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link D-View 8 | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5074", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5074"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link D-View 8", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f0c522e7-6ed0-4d07-a0ee-a629132d48b9", "vulnerability": {"vulnId": "CVE-2024-39713", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f0c522e7-6ed0-4d07-a0ee-a629132d48b9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2024-11-07T19:27:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-07T19:27:09+00:00"}, "scope": {"notes": "Affected: Rocket.Chat / Rocket.Chat | Class: other-software | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-39713", "url": "https://www.cve.org/CVERecord?id=CVE-2024-39713"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rocket.Chat", "30d_avg": 0, "90d_avg": 2, "product": "Rocket.Chat", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "93a76842-562a-4eea-a98c-176974d9997f", "vulnerability": {"vulnId": "CVE-2023-6038", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "93a76842-562a-4eea-a98c-176974d9997f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-10T10:21:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-10T10:21:30+00:00"}, "scope": {"notes": "Affected: h20.ai / h20.ai Dashboard | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6038", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6038"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "h20.ai", "30d_avg": 4, "90d_avg": 4, "product": "h20.ai Dashboard", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8f546b0f-47a6-4a3a-a5b4-6332a37b3a6b", "vulnerability": {"vulnId": "CVE-2021-28151", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f546b0f-47a6-4a3a-a5b4-6332a37b3a6b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:55+00:00"}, "scope": {"notes": "Affected: Hongdian / H8922 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-28151", "url": "https://www.cve.org/CVERecord?id=CVE-2021-28151"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Hongdian", "30d_avg": 5, "90d_avg": 4, "product": "H8922", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ad8a7b70-f407-4f5c-80f6-93021512bc52", "vulnerability": {"vulnId": "CVE-2024-37393", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ad8a7b70-f407-4f5c-80f6-93021512bc52", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-11-12T14:27:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-12T14:27:56+00:00"}, "scope": {"notes": "Affected: SecurEnvoy / SecurEnvoy MFA | Class: security-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-37393", "url": "https://www.cve.org/CVERecord?id=CVE-2024-37393"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "SecurEnvoy", "30d_avg": 0, "90d_avg": 2, "product": "SecurEnvoy MFA", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "ae97a201-d0ef-4c4c-ab4d-e994256ee155", "vulnerability": {"vulnId": "CVE-2024-10914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ae97a201-d0ef-4c4c-ab4d-e994256ee155", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-11-13T08:32:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-13T08:32:44+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-10914", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fc862f17-7e97-48f3-8d18-16155e5c8f67", "vulnerability": {"vulnId": "CVE-2022-22956", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fc862f17-7e97-48f3-8d18-16155e5c8f67", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-25T17:58:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-25T17:58:02+00:00"}, "scope": {"notes": "Affected: VMware / VMware Workspace ONE Access | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22956", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22956"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "VMware", "30d_avg": 5, "90d_avg": 4, "product": "VMware Workspace ONE Access", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ad352b03-b1a2-48f8-a9ca-2f7448cd31e5", "vulnerability": {"vulnId": "CVE-2023-4634", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ad352b03-b1a2-48f8-a9ca-2f7448cd31e5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T20:38:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:38:53+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Media Library Assistant plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4634", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4634"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Media Library Assistant plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5c2e10e8-681d-420c-be68-133c2d98c7f9", "vulnerability": {"vulnId": "CVE-2024-8181", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5c2e10e8-681d-420c-be68-133c2d98c7f9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2024-09-29T21:40:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-29T21:40:59+00:00"}, "scope": {"notes": "Affected: FlowiseAI / Flowise | Class: ai-system | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8181", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8181"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "FlowiseAI", "30d_avg": 0, "90d_avg": 1, "product": "Flowise", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "5733b0ef-4af9-4002-925d-e6103527a14c", "vulnerability": {"vulnId": "CVE-2021-24943", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5733b0ef-4af9-4002-925d-e6103527a14c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Registrations for the Events Calendar plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24943", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24943"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Registrations for the Events Calendar plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a4a23d47-f893-462b-847f-db80312dc097", "vulnerability": {"vulnId": "CVE-2020-24589", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a4a23d47-f893-462b-847f-db80312dc097", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T16:03:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T16:03:14+00:00"}, "scope": {"notes": "Affected: WSO2 / WSO2 API Manager, API Microgateway | Class: security-management-platform | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-24589", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24589"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "WSO2", "30d_avg": 1, "90d_avg": 2, "product": "WSO2 API Manager, API Microgateway", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "ccebec51-8f52-4613-980a-7c6363397c36", "vulnerability": {"vulnId": "CVE-2024-9014", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ccebec51-8f52-4613-980a-7c6363397c36", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2024-10-07T03:07:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-10-07T03:07:22+00:00"}, "scope": {"notes": "Affected: pgAdmin / pgAdmin 4 | Class: database | Severity: Critical (CVSS 9.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9014", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9014"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 1, "vendor": "pgAdmin", "30d_avg": 1, "90d_avg": 2, "product": "pgAdmin 4", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "81c23b2b-c6a0-4c87-ad61-7805231019b5", "vulnerability": {"vulnId": "CVE-2024-48248", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "81c23b2b-c6a0-4c87-ad61-7805231019b5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2025-03-16T13:39:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-16T13:39:36+00:00"}, "scope": {"notes": "Affected: NAKIVO / NAKIVO Backup & Replication | Class: backup | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-48248", "url": "https://www.cve.org/CVERecord?id=CVE-2024-48248"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "backup", "7d_avg": 1, "vendor": "NAKIVO", "30d_avg": 1, "90d_avg": 2, "product": "NAKIVO Backup & Replication", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "4e5a19b1-1a64-4f3a-95d2-cc7e8035ca45", "vulnerability": {"vulnId": "CVE-2021-41293", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4e5a19b1-1a64-4f3a-95d2-cc7e8035ca45", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:14+00:00"}, "scope": {"notes": "Affected: ECOA / ECOA Building Automation System | Class: other-software | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41293", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41293"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ECOA", "30d_avg": 1, "90d_avg": 2, "product": "ECOA Building Automation System", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "593cffde-a1b0-43dc-a404-abeb391907d4", "vulnerability": {"vulnId": "CVE-2022-0781", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "593cffde-a1b0-43dc-a404-abeb391907d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:12:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:12:28+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Nirweb support plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0781", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0781"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Nirweb support plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0d755cef-f714-43e7-9b68-f2d870bb6d08", "vulnerability": {"vulnId": "CVE-2025-1338", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0d755cef-f714-43e7-9b68-f2d870bb6d08", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-04-09T04:17:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-09T04:17:32+00:00"}, "scope": {"notes": "Affected: NUUO / NUUO Camera | Class: video-system | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-1338", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1338"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "NUUO", "30d_avg": 1, "90d_avg": 2, "product": "NUUO Camera", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "7931f34a-5789-43f5-a2a0-f1d598988844", "vulnerability": {"vulnId": "CVE-2021-3129", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7931f34a-5789-43f5-a2a0-f1d598988844", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T21:35:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T21:35:15+00:00"}, "scope": {"notes": "Affected: Laravel / Ignition | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3129", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3129"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 3, "vendor": "Laravel", "30d_avg": 8, "90d_avg": 5, "product": "Ignition", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "89ef6a4f-b0ec-41ed-bbdd-670580ecc213", "vulnerability": {"vulnId": "CVE-2024-1061", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "89ef6a4f-b0ec-41ed-bbdd-670580ecc213", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-14T21:32:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-14T21:32:07+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress HTML5 Video Player plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1061", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1061"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress HTML5 Video Player plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e0b4fa26-e266-46e3-948a-925c1b93121e", "vulnerability": {"vulnId": "CVE-2019-12985", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e0b4fa26-e266-46e3-948a-925c1b93121e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:20+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12985", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12985"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "Citrix", "30d_avg": 5, "90d_avg": 4, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "85eb6859-05ad-49c3-a8dd-7b2bf31b681f", "vulnerability": {"vulnId": "CVE-2023-47253", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "85eb6859-05ad-49c3-a8dd-7b2bf31b681f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-24T19:42:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-24T19:42:39+00:00"}, "scope": {"notes": "Affected: Qualitor / Qualitor ITSM | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-47253", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47253"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Qualitor", "30d_avg": 1, "90d_avg": 2, "product": "Qualitor ITSM", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "80993b27-e952-493d-9995-248649f75963", "vulnerability": {"vulnId": "CVE-2022-4328", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "80993b27-e952-493d-9995-248649f75963", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:40+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WooCommerce Checkout Field Manager plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4328", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4328"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress WooCommerce Checkout Field Manager plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "97da662d-10ab-448e-b60c-ea61d90fd087", "vulnerability": {"vulnId": "CVE-2024-35219", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "97da662d-10ab-448e-b60c-ea61d90fd087", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 83}, "timestamps": {"asserted_at": "2024-12-05T06:27:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:26+00:00"}, "scope": {"notes": "Affected: OpenAPI Tools / OpenAPI Generator | Class: other-software | Severity: High (CVSS 8.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-35219", "url": "https://www.cve.org/CVERecord?id=CVE-2024-35219"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "OpenAPI Tools", "30d_avg": 5, "90d_avg": 3, "product": "OpenAPI Generator", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.3, "vulnerability_severity": "High"}}]}
{"uuid": "2bfc7f02-a422-4ebb-98db-74e84c3a0a86", "vulnerability": {"vulnId": "CVE-2024-29973", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2bfc7f02-a422-4ebb-98db-74e84c3a0a86", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-27T11:11:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-27T11:11:38+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NAS326 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-29973", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29973"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 2, "product": "Zyxel NAS326", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0e3b17a2-1e84-4842-a746-eb42a3cefdb7", "vulnerability": {"vulnId": "CVE-2023-27350", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e3b17a2-1e84-4842-a746-eb42a3cefdb7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:47+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut MF/NG | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27350", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27350"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "PaperCut", "30d_avg": 4, "90d_avg": 3, "product": "PaperCut MF/NG", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "22560854-0711-4708-8ee3-290ae53296a4", "vulnerability": {"vulnId": "CVE-2023-46574", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "22560854-0711-4708-8ee3-290ae53296a4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-09T02:55:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-09T02:55:29+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A3700R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-46574", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46574"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 5, "90d_avg": 4, "product": "Totolink A3700R", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c47a8a36-fe88-4f18-97f8-b0c481da963b", "vulnerability": {"vulnId": "CVE-2023-4490", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c47a8a36-fe88-4f18-97f8-b0c481da963b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-03T18:43:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-03T18:43:20+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WP Job Portal plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4490", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4490"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress WP Job Portal plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5366384f-3ba5-4fff-8ba0-dcba8e07d4be", "vulnerability": {"vulnId": "CVE-2021-34993", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5366384f-3ba5-4fff-8ba0-dcba8e07d4be", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: Commvault / CommCell | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-34993", "url": "https://www.cve.org/CVERecord?id=CVE-2021-34993"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Commvault", "30d_avg": 1, "90d_avg": 0, "product": "CommCell", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ceccd174-73a5-4030-88e4-079c3636e0d4", "vulnerability": {"vulnId": "CVE-2022-1952", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ceccd174-73a5-4030-88e4-079c3636e0d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:31:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:31:57+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Free Booking Plugin for Hotels, Restaurant and Car Rental (eaSYNC) | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1952"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Free Booking Plugin for Hotels, Restaurant and Car Rental (eaSYNC)", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7b10aa2c-64f3-48b8-8e44-d17af0a935f6", "vulnerability": {"vulnId": "CVE-2024-57049", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7b10aa2c-64f3-48b8-8e44-d17af0a935f6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-05-09T04:40:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-09T04:40:08+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link Archer C20 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-57049", "url": "https://www.cve.org/CVERecord?id=CVE-2024-57049"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "TP-Link", "30d_avg": 0, "90d_avg": 2, "product": "TP-Link Archer C20", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0cb49db6-11d8-4694-884b-c3fa8ed7bb4b", "vulnerability": {"vulnId": "CVE-2022-40881", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0cb49db6-11d8-4694-884b-c3fa8ed7bb4b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:39+00:00"}, "scope": {"notes": "Affected: CONTEC / SolarView Compact | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40881"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "CONTEC", "30d_avg": 1, "90d_avg": 2, "product": "SolarView Compact", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5a1d5c82-009f-4231-a14d-19f06dc424e5", "vulnerability": {"vulnId": "CVE-2021-37291", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5a1d5c82-009f-4231-a14d-19f06dc424e5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T22:14:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T22:14:32+00:00"}, "scope": {"notes": "Affected: KevinLAB / Building Energy Management System | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-37291", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37291"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "KevinLAB", "30d_avg": 1, "90d_avg": 2, "product": "Building Energy Management System", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d9b7a7b3-9303-4526-8424-ae795fc52c62", "vulnerability": {"vulnId": "CVE-2021-41653", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d9b7a7b3-9303-4526-8424-ae795fc52c62", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:42:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:42:00+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link TL-WR840N EU v5 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41653", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41653"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "TP-Link", "30d_avg": 4, "90d_avg": 4, "product": "TP-Link TL-WR840N EU v5", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "40a21efe-0551-43c0-851a-af341762fe40", "vulnerability": {"vulnId": "CVE-2024-4325", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "40a21efe-0551-43c0-851a-af341762fe40", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2024-09-25T12:58:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-25T12:58:53+00:00"}, "scope": {"notes": "Affected: Gradio / Gradio | Class: ai-system | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4325", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4325"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "Gradio", "30d_avg": 4, "90d_avg": 3, "product": "Gradio", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "2321c67f-a22a-4ead-9d2a-c793c7e3faf8", "vulnerability": {"vulnId": "CVE-2018-11511", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2321c67f-a22a-4ead-9d2a-c793c7e3faf8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-26T03:18:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-26T03:18:26+00:00"}, "scope": {"notes": "Affected: ASUSTOR / ASUSTOR ADM | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11511"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "ASUSTOR", "30d_avg": 1, "90d_avg": 2, "product": "ASUSTOR ADM", "cisa_kev": "no", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6f966d24-42ac-4ff5-9f48-3b38e4abddc4", "vulnerability": {"vulnId": "CVE-2020-8656", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6f966d24-42ac-4ff5-9f48-3b38e4abddc4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:35:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:35:22+00:00"}, "scope": {"notes": "Affected: EyesOfNetwork / EyesOfNetwork | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8656", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8656"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 1, "vendor": "EyesOfNetwork", "30d_avg": 5, "90d_avg": 3, "product": "EyesOfNetwork", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "345d3211-05c8-41bb-9e95-ffc4093f556d", "vulnerability": {"vulnId": "CVE-2021-33044", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "345d3211-05c8-41bb-9e95-ffc4093f556d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:59+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua (multiple products) | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-33044", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33044"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Dahua", "30d_avg": 1, "90d_avg": 2, "product": "Dahua (multiple products)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0af1385c-f210-4229-bee4-6763bb57c80e", "vulnerability": {"vulnId": "CVE-2020-6287", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0af1385c-f210-4229-bee4-6763bb57c80e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T14:56:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:39+00:00"}, "scope": {"notes": "Affected: SAP / NetWeaver AS JAVA (LM Configuration Wizard) | Class: app-server | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-6287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-6287"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "SAP", "30d_avg": 1, "90d_avg": 2, "product": "NetWeaver AS JAVA (LM Configuration Wizard)", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "db98cb31-36f0-4d78-9ea0-7ccabb3bbf8c", "vulnerability": {"vulnId": "CVE-2021-27850", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "db98cb31-36f0-4d78-9ea0-7ccabb3bbf8c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:55+00:00"}, "scope": {"notes": "Affected: Apache / Tapestry | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27850", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27850"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Apache", "30d_avg": 4, "90d_avg": 3, "product": "Tapestry", "cisa_kev": "no", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "990635e2-39f2-4589-a915-b7e7df8e5447", "vulnerability": {"vulnId": "CVE-2019-12986", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "990635e2-39f2-4589-a915-b7e7df8e5447", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:08:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:08:27+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12986", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12986"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "Citrix", "30d_avg": 5, "90d_avg": 4, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ffed2428-e0b9-4f18-89b8-9f38d21f5bec", "vulnerability": {"vulnId": "CVE-2025-1302", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ffed2428-e0b9-4f18-89b8-9f38d21f5bec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-19T22:56:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-19T22:56:47+00:00"}, "scope": {"notes": "Affected: JSONPath-Plus / JSONPath-plus | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-1302", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1302"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "JSONPath-Plus", "30d_avg": 1, "90d_avg": 2, "product": "JSONPath-plus", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "65b60f9f-a0a0-4edd-b426-27afe2f083ab", "vulnerability": {"vulnId": "CVE-2023-20887", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "65b60f9f-a0a0-4edd-b426-27afe2f083ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:43+00:00"}, "scope": {"notes": "Affected: VMware / Aria Operations for Networks | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-20887", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20887"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "VMware", "30d_avg": 1, "90d_avg": 2, "product": "Aria Operations for Networks", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6e47bc5f-acfd-4a4c-bb19-0487116ec779", "vulnerability": {"vulnId": "CVE-2018-11686", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6e47bc5f-acfd-4a4c-bb19-0487116ec779", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T18:13:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-18T18:13:41+00:00"}, "scope": {"notes": "Affected: FlexPaper (Flowpaper) / FlexPaper (Flowpaper) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 26", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11686", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11686"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "FlexPaper (Flowpaper)", "30d_avg": 6, "90d_avg": 4, "product": "FlexPaper (Flowpaper)", "cisa_kev": "no", "connections": 26, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "74c4ae7e-9608-42a5-b866-e741b89ce7a9", "vulnerability": {"vulnId": "CVE-2024-20439", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "74c4ae7e-9608-42a5-b866-e741b89ce7a9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-02T17:59:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-02T17:59:29+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Smart Licensing Utility (CSLU) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-20439", "url": "https://www.cve.org/CVERecord?id=CVE-2024-20439"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 2, "product": "Cisco Smart Licensing Utility (CSLU)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c543b95f-2c31-4c83-b11c-bb40fd4a3666", "vulnerability": {"vulnId": "CVE-2018-25114", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c543b95f-2c31-4c83-b11c-bb40fd4a3666", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-12T16:28:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-12T16:28:08+00:00"}, "scope": {"notes": "Affected: osCommerce / osCommerce Online Merchant | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-25114", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25114"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "osCommerce", "30d_avg": 5, "90d_avg": 4, "product": "osCommerce Online Merchant", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "dc56fc31-5266-4db9-ac8a-772ab4957220", "vulnerability": {"vulnId": "CVE-2018-16763", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dc56fc31-5266-4db9-ac8a-772ab4957220", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:41:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:41:37+00:00"}, "scope": {"notes": "Affected: Daylight Studio / FUEL CMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-16763", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16763"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Daylight Studio", "30d_avg": 1, "90d_avg": 2, "product": "FUEL CMS", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f8f15323-cbd0-4d56-8040-9ed091d827a3", "vulnerability": {"vulnId": "CVE-2017-1000170", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8f15323-cbd0-4d56-8040-9ed091d827a3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:55:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:24+00:00"}, "scope": {"notes": "Affected: jQueryFileTree / jQueryFileTree | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-1000170", "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000170"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "jQueryFileTree", "30d_avg": 1, "90d_avg": 2, "product": "jQueryFileTree", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "49d13cbd-29c0-49bf-8ae2-ab44bd97e4c8", "vulnerability": {"vulnId": "CVE-2025-3102", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "49d13cbd-29c0-49bf-8ae2-ab44bd97e4c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2025-06-23T08:22:33+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-23T08:22:33+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress SureTriggers: All-in-One Automation Platform plugin | Class: cms | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-3102", "url": "https://www.cve.org/CVERecord?id=CVE-2025-3102"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress SureTriggers: All-in-One Automation Platform plugin", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "0b51f17f-1ec5-4253-b03c-01ccb95f050d", "vulnerability": {"vulnId": "CVE-2018-2894", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0b51f17f-1ec5-4253-b03c-01ccb95f050d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:17+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-2894", "url": "https://www.cve.org/CVERecord?id=CVE-2018-2894"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "Oracle", "30d_avg": 5, "90d_avg": 3, "product": "Oracle Weblogic Server", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "96604e07-7f2a-4c8c-8755-3523d1b7c0ce", "vulnerability": {"vulnId": "CVE-2016-10108", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "96604e07-7f2a-4c8c-8755-3523d1b7c0ce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-07T13:47:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-07T13:47:57+00:00"}, "scope": {"notes": "Affected: Western Digital / MyCloud NAS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-10108", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10108"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "Western Digital", "30d_avg": 1, "90d_avg": 2, "product": "MyCloud NAS", "cisa_kev": "no", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "da2118d8-cd8b-4e83-936a-34f0cc04b330", "vulnerability": {"vulnId": "CVE-2018-3760", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "da2118d8-cd8b-4e83-936a-34f0cc04b330", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:00+00:00"}, "scope": {"notes": "Affected: Ruby on Rails / Sprockets | Class: web-app-framework | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-3760", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3760"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Ruby on Rails", "30d_avg": 5, "90d_avg": 4, "product": "Sprockets", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1b0097b7-5246-45b1-aa41-cf6b3232f4a2", "vulnerability": {"vulnId": "CVE-2017-6090", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b0097b7-5246-45b1-aa41-cf6b3232f4a2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:55:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:43+00:00"}, "scope": {"notes": "Affected: phpCollab / phpCollab | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-6090", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6090"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "phpCollab", "30d_avg": 5, "90d_avg": 4, "product": "phpCollab", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "98b8f172-407c-4293-90b1-bac50977693f", "vulnerability": {"vulnId": "CVE-2023-23489", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "98b8f172-407c-4293-90b1-bac50977693f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:44+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Easy Digital Downloads plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-23489", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23489"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 3, "product": "Wordpress Easy Digital Downloads plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1b26b62a-da76-499d-90ac-46ad2a554239", "vulnerability": {"vulnId": "CVE-2026-42271", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b26b62a-da76-499d-90ac-46ad2a554239", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:17:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-06T11:17:45+00:00"}, "scope": {"notes": "Affected: LiteLLM / LiteLLM | Class: ai-system | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 331", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-42271", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42271"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "280", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 247, "vendor": "LiteLLM", "30d_avg": 78, "90d_avg": 26, "product": "LiteLLM", "cisa_kev": "yes", "connections": 331, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "51aac7bd-594f-439d-aa79-656c797e4de4", "vulnerability": {"vulnId": "CVE-2019-7192", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "51aac7bd-594f-439d-aa79-656c797e4de4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T20:10:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T20:10:39+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP NAS devices running Photo Station | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-7192", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7192"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 4, "vendor": "QNAP", "30d_avg": 10, "90d_avg": 9, "product": "QNAP NAS devices running Photo Station", "cisa_kev": "yes", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "935a1e92-847c-46a6-8479-b9a7ff907c8a", "vulnerability": {"vulnId": "CVE-2021-24931", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "935a1e92-847c-46a6-8479-b9a7ff907c8a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-15T18:13:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T18:13:42+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Secure Copy Content Protection and Content Locking plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24931", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24931"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 3, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 6, "product": "Wordpress Secure Copy Content Protection and Content Locking plugin", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7b21bf96-a203-4f37-99b9-f47850987405", "vulnerability": {"vulnId": "CVE-2019-7256", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7b21bf96-a203-4f37-99b9-f47850987405", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T14:56:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:12+00:00"}, "scope": {"notes": "Affected: Linear / eMerge E3-Series | Class: other-software | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-7256", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7256"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Linear", "30d_avg": 5, "90d_avg": 5, "product": "eMerge E3-Series", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "d27a28a4-ccc3-4a72-9066-7fce5b0cbb4d", "vulnerability": {"vulnId": "CVE-2023-0159", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d27a28a4-ccc3-4a72-9066-7fce5b0cbb4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-08-17T14:59:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-17T14:59:54+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Extensive VC Addons for WPBakery page builder plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0159", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0159"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress Extensive VC Addons for WPBakery page builder plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "bb558845-2e34-4e18-ada4-d63fcf65a92d", "vulnerability": {"vulnId": "CVE-2001-0537", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bb558845-2e34-4e18-ada4-d63fcf65a92d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2023-10-14T13:53:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T13:53:03+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco IOS | Class: router | Severity: High (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2001-0537", "url": "https://www.cve.org/CVERecord?id=CVE-2001-0537"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Cisco", "30d_avg": 8, "90d_avg": 5, "product": "Cisco IOS", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "High"}}]}
{"uuid": "0018b237-9cfb-4884-97b1-fa556aa5c174", "vulnerability": {"vulnId": "CVE-2024-3721", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0018b237-9cfb-4884-97b1-fa556aa5c174", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-04-21T15:14:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-21T15:14:47+00:00"}, "scope": {"notes": "Affected: TBK / TBK DVR-4104/DVR-4216 | Class: video-system | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 120", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-3721", "url": "https://www.cve.org/CVERecord?id=CVE-2024-3721"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 3, "vendor": "TBK", "30d_avg": 2, "90d_avg": 3, "product": "TBK DVR-4104/DVR-4216", "cisa_kev": "no", "connections": 120, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "295620ce-b298-4a38-8cae-0a4e622826fd", "vulnerability": {"vulnId": "CVE-2020-10546", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "295620ce-b298-4a38-8cae-0a4e622826fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:56:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:16+00:00"}, "scope": {"notes": "Affected: rConfig / rConfig | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10546"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "rConfig", "30d_avg": 0, "90d_avg": 1, "product": "rConfig", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "49d6289e-1c06-4f60-9dcb-0349a7206080", "vulnerability": {"vulnId": "CVE-2026-1207", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "49d6289e-1c06-4f60-9dcb-0349a7206080", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:34:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-07-06T11:34:45+00:00"}, "scope": {"notes": "Affected: Django / Django RasterField | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1207", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Django", "30d_avg": 0, "90d_avg": 0, "product": "Django RasterField", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ecd5cf17-cc93-4244-8431-d78e674f04bb", "vulnerability": {"vulnId": "CVE-2022-35413", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ecd5cf17-cc93-4244-8431-d78e674f04bb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:36+00:00"}, "scope": {"notes": "Affected: Penta Security / WAPPLES | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-35413", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35413"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Penta Security", "30d_avg": 1, "90d_avg": 2, "product": "WAPPLES", "cisa_kev": "no", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "456bc5b2-a7d9-4963-b1ea-e2e3c4d9948d", "vulnerability": {"vulnId": "CVE-2022-27593", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "456bc5b2-a7d9-4963-b1ea-e2e3c4d9948d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 90}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP NAS devices running Photo Station | Class: nas | Severity: Critical (CVSS 9) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-27593", "url": "https://www.cve.org/CVERecord?id=CVE-2022-27593"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 1, "product": "QNAP NAS devices running Photo Station", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9, "vulnerability_severity": "Critical"}}]}
{"uuid": "8e62da3c-7a16-4620-99de-da436c3688aa", "vulnerability": {"vulnId": "CVE-2023-20073", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8e62da3c-7a16-4620-99de-da436c3688aa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-22T03:56:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-22T03:56:40+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-20073", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20073"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "66fc5325-f457-4c0c-a69f-42193a4e2803", "vulnerability": {"vulnId": "CVE-2025-54123", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "66fc5325-f457-4c0c-a69f-42193a4e2803", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-10T18:00:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-10T18:00:52+00:00"}, "scope": {"notes": "Affected: SpectoLabs / HoverFly | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54123", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54123"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SpectoLabs", "30d_avg": 0, "90d_avg": 2, "product": "HoverFly", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c47f37ee-9801-4ef3-a88b-4c9749d6226b", "vulnerability": {"vulnId": "CVE-2022-47615", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c47f37ee-9801-4ef3-a88b-4c9749d6226b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-06T23:05:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-06T23:05:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-47615", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47615"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ef7da801-e722-4100-98cb-92b9d875ceee", "vulnerability": {"vulnId": "CVE-2022-29078", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ef7da801-e722-4100-98cb-92b9d875ceee", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-18T00:55:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-18T00:55:37+00:00"}, "scope": {"notes": "Affected: Node.js / Node.js (ejs) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29078", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29078"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Node.js", "30d_avg": 1, "90d_avg": 2, "product": "Node.js (ejs)", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "45f6086a-01d0-4f7a-9ad2-200918dddcad", "vulnerability": {"vulnId": "CVE-2020-22165", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "45f6086a-01d0-4f7a-9ad2-200918dddcad", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:37+00:00"}, "scope": {"notes": "Affected: PHPGurukul / Hospital Management System | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-22165", "url": "https://www.cve.org/CVERecord?id=CVE-2020-22165"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "PHPGurukul", "30d_avg": 1, "90d_avg": 2, "product": "Hospital Management System", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e92dc555-4a24-41bf-8a64-03edfaed19f9", "vulnerability": {"vulnId": "CVE-2023-29919", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e92dc555-4a24-41bf-8a64-03edfaed19f9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T14:57:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:48+00:00"}, "scope": {"notes": "Affected: CONTEC / SolarView Compact | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-29919", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29919"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "CONTEC", "30d_avg": 1, "90d_avg": 2, "product": "SolarView Compact", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "b1a9a75a-c095-4ffb-9abe-9dff3d288414", "vulnerability": {"vulnId": "CVE-2024-25735", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b1a9a75a-c095-4ffb-9abe-9dff3d288414", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-03-03T18:46:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-03T18:46:48+00:00"}, "scope": {"notes": "Affected: WyreStorm / WyreStorm Apollo VX20 | Class: video-system | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-25735", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25735"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "WyreStorm", "30d_avg": 1, "90d_avg": 1, "product": "WyreStorm Apollo VX20", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "1fed9616-6a1a-417d-98db-866fdb1b1596", "vulnerability": {"vulnId": "CVE-2021-27670", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fed9616-6a1a-417d-98db-866fdb1b1596", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-21T08:39:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:39:37+00:00"}, "scope": {"notes": "Affected: Appspace / Appspace | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27670", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27670"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Appspace", "30d_avg": 0, "90d_avg": 1, "product": "Appspace", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4475dd4b-501a-48b7-a71f-2bd9dc6bacdd", "vulnerability": {"vulnId": "CVE-2019-12314", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4475dd4b-501a-48b7-a71f-2bd9dc6bacdd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-12T18:48:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-12T18:48:37+00:00"}, "scope": {"notes": "Affected: Deltek / Deltek Maconomy | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12314", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Deltek", "30d_avg": 0, "90d_avg": 1, "product": "Deltek Maconomy", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9da4b6b1-afbf-438a-ace2-5153fff01e1f", "vulnerability": {"vulnId": "CVE-2023-38205", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9da4b6b1-afbf-438a-ace2-5153fff01e1f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-10T13:01:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-10T13:01:38+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-38205", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38205"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 1, "product": "ColdFusion", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8aabfb64-ee4d-4cc3-8d5c-f5e61dc063d1", "vulnerability": {"vulnId": "CVE-2023-26256", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8aabfb64-ee4d-4cc3-8d5c-f5e61dc063d1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-19T08:11:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T08:11:51+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA STAGIL Navigation for Jira - Menu & Themes plugin | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26256", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26256"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 9, "product": "JIRA STAGIL Navigation for Jira - Menu & Themes plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "073cf575-1495-4a1c-9105-00d3462b4108", "vulnerability": {"vulnId": "CVE-2017-10974", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "073cf575-1495-4a1c-9105-00d3462b4108", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:55:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:19+00:00"}, "scope": {"notes": "Affected: Yaws / Yaws | Class: web-server | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-10974", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10974"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Yaws", "30d_avg": 0, "90d_avg": 1, "product": "Yaws", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c078fe7d-18e2-48d5-a904-4fc402c1a1d5", "vulnerability": {"vulnId": "CVE-2025-34026", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c078fe7d-18e2-48d5-a904-4fc402c1a1d5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-21T20:43:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-21T20:43:13+00:00"}, "scope": {"notes": "Affected: Versa / Versa Concerto | Class: device-management-platform | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34026", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34026"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Versa", "30d_avg": 0, "90d_avg": 1, "product": "Versa Concerto", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "c71a65dd-9338-4ccc-9b28-d0c04e02f85d", "vulnerability": {"vulnId": "CVE-2022-0656", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c71a65dd-9338-4ccc-9b28-d0c04e02f85d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:19+00:00"}, "scope": {"notes": "Affected: Wordpress / Web To Print Shop : uDraw plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0656", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0656"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Web To Print Shop : uDraw plugin", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e47a54f8-2ccf-4322-8451-9bcfbe594906", "vulnerability": {"vulnId": "CVE-2023-26258", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e47a54f8-2ccf-4322-8451-9bcfbe594906", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-19T06:22:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-19T06:22:58+00:00"}, "scope": {"notes": "Affected: Arcserve / Arcserve Unified Data Protection (UDP) | Class: backup | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26258", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26258"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "backup", "7d_avg": 1, "vendor": "Arcserve", "30d_avg": 5, "90d_avg": 4, "product": "Arcserve Unified Data Protection (UDP)", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "76dc3243-fbcd-4790-8643-ecb1b428f706", "vulnerability": {"vulnId": "CVE-2020-35476", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "76dc3243-fbcd-4790-8643-ecb1b428f706", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: OpenTSDB / OpenTSDB | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-35476", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35476"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "OpenTSDB", "30d_avg": 0, "90d_avg": 1, "product": "OpenTSDB", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cbbb24cf-4110-4fb7-bdec-8db46f3d1401", "vulnerability": {"vulnId": "CVE-2025-54782", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cbbb24cf-4110-4fb7-bdec-8db46f3d1401", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-08-18T13:49:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-18T13:49:18+00:00"}, "scope": {"notes": "Affected: Nest / Nest | Class: web-app-framework | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54782", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54782"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Nest", "30d_avg": 0, "90d_avg": 1, "product": "Nest", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "5f2581b6-55d5-4029-afe6-94706c0030bc", "vulnerability": {"vulnId": "CVE-2017-18378", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5f2581b6-55d5-4029-afe6-94706c0030bc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T22:25:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T22:25:59+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR ReadyNAS Surveillance | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-18378", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18378"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 0, "90d_avg": 2, "product": "NETGEAR ReadyNAS Surveillance", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "58e46aa2-dbbe-459e-9f93-2f1c21ff670a", "vulnerability": {"vulnId": "CVE-2018-20470", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "58e46aa2-dbbe-459e-9f93-2f1c21ff670a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-12-28T11:44:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-28T11:44:03+00:00"}, "scope": {"notes": "Affected: Sahi Pro / Sahi Pro | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-20470", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20470"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Sahi Pro", "30d_avg": 0, "90d_avg": 1, "product": "Sahi Pro", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "209c94f9-1e34-4689-bd64-2c9fbf9de318", "vulnerability": {"vulnId": "CVE-2020-15920", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "209c94f9-1e34-4689-bd64-2c9fbf9de318", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:51:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:51:41+00:00"}, "scope": {"notes": "Affected: Mida Solutions / Mida eFramework | Class: ip-pbx | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15920", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15920"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "Mida Solutions", "30d_avg": 0, "90d_avg": 1, "product": "Mida eFramework", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "dcd4c9a2-b36f-4991-9b56-75ac493c6923", "vulnerability": {"vulnId": "CVE-2025-52488", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dcd4c9a2-b36f-4991-9b56-75ac493c6923", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2025-07-31T15:09:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-31T15:09:53+00:00"}, "scope": {"notes": "Affected: DNN Corp / DNN (DotNetNuke) | Class: cms | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-52488", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52488"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "DNN Corp", "30d_avg": 0, "90d_avg": 1, "product": "DNN (DotNetNuke)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "e52cbb9a-7bbf-4970-b87b-4c4e5628eaee", "vulnerability": {"vulnId": "CVE-2022-24816", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e52cbb9a-7bbf-4970-b87b-4c4e5628eaee", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver (JAI-EXT) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24816", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24816"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "Geoserver", "30d_avg": 7, "90d_avg": 5, "product": "Geoserver (JAI-EXT)", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "db3c364e-cb98-4a9e-be5b-d193a3729287", "vulnerability": {"vulnId": "CVE-2024-6671", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "db3c364e-cb98-4a9e-be5b-d193a3729287", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-23T14:21:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-02-23T14:21:53+00:00"}, "scope": {"notes": "Affected: Progress / WhatsUp Gold | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6671", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6671"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Progress", "30d_avg": 4, "90d_avg": 4, "product": "WhatsUp Gold", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4cbea5b6-175b-4f7e-b4a3-b37bcddd428b", "vulnerability": {"vulnId": "CVE-2019-5127", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4cbea5b6-175b-4f7e-b4a3-b37bcddd428b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:12+00:00"}, "scope": {"notes": "Affected: YouPHPTube / YouPHPTube Encoder | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-5127", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5127"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "YouPHPTube", "30d_avg": 5, "90d_avg": 4, "product": "YouPHPTube Encoder", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "35c21e03-c73a-4aef-bcdb-b3a212c06f7e", "vulnerability": {"vulnId": "CVE-2021-39144", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "35c21e03-c73a-4aef-bcdb-b3a212c06f7e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 85}, "timestamps": {"asserted_at": "2023-10-23T22:59:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T22:59:24+00:00"}, "scope": {"notes": "Affected: VMware / VMware NSX Manager XStream | Class: device-management-platform | Severity: High (CVSS 8.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39144", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39144"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "VMware", "30d_avg": 0, "90d_avg": 0, "product": "VMware NSX Manager XStream", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.5, "vulnerability_severity": "High"}}]}
{"uuid": "2adee1b8-90e1-42a2-b135-815ff058b471", "vulnerability": {"vulnId": "CVE-2019-5434", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2adee1b8-90e1-42a2-b135-815ff058b471", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T11:38:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T11:38:53+00:00"}, "scope": {"notes": "Affected: Revive / Revive Adserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-5434", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5434"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Revive", "30d_avg": 4, "90d_avg": 3, "product": "Revive Adserver", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "858ac9ce-9294-40e4-b59e-bf97003dc71e", "vulnerability": {"vulnId": "CVE-2021-27964", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "858ac9ce-9294-40e4-b59e-bf97003dc71e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:59+00:00"}, "scope": {"notes": "Affected: Sonlogger / Sonlogger | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27964", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27964"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Sonlogger", "30d_avg": 9, "90d_avg": 8, "product": "Sonlogger", "cisa_kev": "no", "connections": 14, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4731b173-3707-453f-9bac-0602f59e6ad9", "vulnerability": {"vulnId": "CVE-2021-45382", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4731b173-3707-453f-9bac-0602f59e6ad9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:04:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:04:42+00:00"}, "scope": {"notes": "Affected: D-Link / DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, DIR-836L | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-45382", "url": "https://www.cve.org/CVERecord?id=CVE-2021-45382"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "D-Link", "30d_avg": 3, "90d_avg": 3, "product": "DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, DIR-836L", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "80d7759b-0d48-4e8f-8193-20ac39c9c99a", "vulnerability": {"vulnId": "CVE-2022-1388", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "80d7759b-0d48-4e8f-8193-20ac39c9c99a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:37+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1388", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1388"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 2, "vendor": "F5", "30d_avg": 6, "90d_avg": 5, "product": "BIG-IP", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7652bc8c-c2da-4dc9-8c8c-8576b72f3592", "vulnerability": {"vulnId": "CVE-2020-12720", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7652bc8c-c2da-4dc9-8c8c-8576b72f3592", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:19+00:00"}, "scope": {"notes": "Affected: vBulletin / vBulletin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-12720", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12720"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "vBulletin", "30d_avg": 1, "90d_avg": 2, "product": "vBulletin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b4990e5b-9974-4a69-b1c7-8ed63f2d7faf", "vulnerability": {"vulnId": "CVE-2020-8515", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b4990e5b-9974-4a69-b1c7-8ed63f2d7faf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:41+00:00"}, "scope": {"notes": "Affected: Draytek / Draytek Vigor2960, Vigor3900, Vigor300B | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8515", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8515"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Draytek", "30d_avg": 1, "90d_avg": 2, "product": "Draytek Vigor2960, Vigor3900, Vigor300B", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4810dcf1-e787-4331-b66d-0102d910e3f2", "vulnerability": {"vulnId": "CVE-2019-7238", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4810dcf1-e787-4331-b66d-0102d910e3f2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:12+00:00"}, "scope": {"notes": "Affected: Sonatype / Nexus Repository Manager | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-7238", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7238"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Sonatype", "30d_avg": 1, "90d_avg": 3, "product": "Nexus Repository Manager", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "42ac919a-d77c-4956-a4ca-711b3c71c2c6", "vulnerability": {"vulnId": "CVE-2024-28995", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "42ac919a-d77c-4956-a4ca-711b3c71c2c6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-06-25T21:58:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-25T21:58:01+00:00"}, "scope": {"notes": "Affected: SolarWinds / SolarWinds Serv-U | Class: file-transfer | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1748", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-28995", "url": "https://www.cve.org/CVERecord?id=CVE-2024-28995"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "12", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 12, "vendor": "SolarWinds", "30d_avg": 13, "90d_avg": 9, "product": "SolarWinds Serv-U", "cisa_kev": "yes", "connections": 1748, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "18ecbe13-5eed-419f-95a0-83b04464c584", "vulnerability": {"vulnId": "CVE-2017-7927", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "18ecbe13-5eed-419f-95a0-83b04464c584", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2023-10-14T14:26:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:26:42+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua DVR/NVR/IPC | Class: video-system | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 28", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-7927", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7927"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 2, "vendor": "Dahua", "30d_avg": 2, "90d_avg": 3, "product": "Dahua DVR/NVR/IPC", "cisa_kev": "no", "connections": 28, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "13da2bdb-2241-4429-8eca-4ecb21e8a7c2", "vulnerability": {"vulnId": "CVE-2022-39952", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "13da2bdb-2241-4429-8eca-4ecb21e8a7c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:38+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiNAC | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-39952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39952"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Fortinet", "30d_avg": 1, "90d_avg": 2, "product": "FortiNAC", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5055a1c0-ab68-4ec6-b604-d4b5d78de64d", "vulnerability": {"vulnId": "CVE-2025-0107", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5055a1c0-ab68-4ec6-b604-d4b5d78de64d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 77}, "timestamps": {"asserted_at": "2026-01-15T19:26:03+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-15T19:26:03+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / Palo Alto Networks Expedition | Class: other-software | Severity: High (CVSS 7.7) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-0107", "url": "https://www.cve.org/CVERecord?id=CVE-2025-0107"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Palo Alto Networks", "30d_avg": 1, "90d_avg": 2, "product": "Palo Alto Networks Expedition", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.7, "vulnerability_severity": "High"}}]}
{"uuid": "e5560b2f-215e-4178-9e4e-fe15b3560df5", "vulnerability": {"vulnId": "CVE-2025-34068", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e5560b2f-215e-4178-9e4e-fe15b3560df5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:38:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:38:22+00:00"}, "scope": {"notes": "Affected: Samsung / WLAN AP WEA453e | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34068", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34068"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Samsung", "30d_avg": 0, "90d_avg": 0, "product": "WLAN AP WEA453e", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2d91dca5-4f3a-4285-aeef-12a492766d63", "vulnerability": {"vulnId": "CVE-2025-55161", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2d91dca5-4f3a-4285-aeef-12a492766d63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-07T16:13:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-07T16:13:56+00:00"}, "scope": {"notes": "Affected: Stirling Tools / Stirling-PDF | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-55161", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55161"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Stirling Tools", "30d_avg": 0, "90d_avg": 1, "product": "Stirling-PDF", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1e78c2fe-ff21-478d-9875-d7fbf8883cd2", "vulnerability": {"vulnId": "CVE-2023-37999", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1e78c2fe-ff21-478d-9875-d7fbf8883cd2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-18T03:38:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-18T03:38:57+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress HasThemes HT Mega | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-37999", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37999"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 3, "product": "Wordpress HasThemes HT Mega", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "464b7f3d-0c16-4412-a9aa-0c295911257b", "vulnerability": {"vulnId": "CVE-2017-9506", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "464b7f3d-0c16-4412-a9aa-0c295911257b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-04-15T08:29:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-15T08:29:24+00:00"}, "scope": {"notes": "Affected: Atlassian / Atlassian OAuth Plugin | Class: security-management-platform | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-9506", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9506"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 0, "product": "Atlassian OAuth Plugin", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "433d5d44-5594-4372-b75b-b059f3477db8", "vulnerability": {"vulnId": "CVE-2023-28432", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "433d5d44-5594-4372-b75b-b059f3477db8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:48+00:00"}, "scope": {"notes": "Affected: MinIO / MinIO | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-28432", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28432"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "MinIO", "30d_avg": 2, "90d_avg": 2, "product": "MinIO", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "6ea5aba8-35a5-42fa-b0ce-32c9d65e8db4", "vulnerability": {"vulnId": "CVE-2022-34753", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6ea5aba8-35a5-42fa-b0ce-32c9d65e8db4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:36+00:00"}, "scope": {"notes": "Affected: Schneider Electric / SpaceLogic C-Bus Home Controller (5200WHC2) | Class: other-software | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-34753", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34753"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Schneider Electric", "30d_avg": 1, "90d_avg": 2, "product": "SpaceLogic C-Bus Home Controller (5200WHC2)", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "84af859d-9d64-4564-b756-0b55e5e44a5f", "vulnerability": {"vulnId": "CVE-2021-1497", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "84af859d-9d64-4564-b756-0b55e5e44a5f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:44+00:00"}, "scope": {"notes": "Affected: Cisco / HyperFlex HX | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-1497", "url": "https://www.cve.org/CVERecord?id=CVE-2021-1497"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 2, "product": "HyperFlex HX", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e85d200b-ae94-4524-8f2d-b5eda60ffca1", "vulnerability": {"vulnId": "CVE-2025-10204", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e85d200b-ae94-4524-8f2d-b5eda60ffca1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 71}, "timestamps": {"asserted_at": "2025-12-31T08:04:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-12-31T08:04:20+00:00"}, "scope": {"notes": "Affected: LG / LG AC Smart II | Class: device-management-platform | Severity: High (CVSS 7.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-10204", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10204"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "LG", "30d_avg": 1, "90d_avg": 1, "product": "LG AC Smart II", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.1, "vulnerability_severity": "High"}}]}
{"uuid": "403054b3-fc21-4f2b-807e-51aa9c4134ed", "vulnerability": {"vulnId": "CVE-2020-21650", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "403054b3-fc21-4f2b-807e-51aa9c4134ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T22:21:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T22:21:49+00:00"}, "scope": {"notes": "Affected: Myucms / Myucms | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-21650", "url": "https://www.cve.org/CVERecord?id=CVE-2020-21650"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Myucms", "30d_avg": 0, "90d_avg": 0, "product": "Myucms", "cisa_kev": "no", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "57e009d0-07a6-46db-a249-b7fea64a49e6", "vulnerability": {"vulnId": "CVE-2025-58360", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "57e009d0-07a6-46db-a249-b7fea64a49e6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-12-16T18:10:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-12-16T18:10:01+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 286", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-58360", "url": "https://www.cve.org/CVERecord?id=CVE-2025-58360"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 8, "vendor": "Geoserver", "30d_avg": 6, "90d_avg": 5, "product": "Geoserver", "cisa_kev": "yes", "connections": 286, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "97a5343e-e85c-4d16-8a3f-3e10e5eb9cd2", "vulnerability": {"vulnId": "CVE-2019-12276", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "97a5343e-e85c-4d16-8a3f-3e10e5eb9cd2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:02+00:00"}, "scope": {"notes": "Affected: GrandNode / GrandNode | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12276", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12276"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GrandNode", "30d_avg": 0, "90d_avg": 2, "product": "GrandNode", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2635d3be-5474-46ce-b8e1-85df1ffa1e7b", "vulnerability": {"vulnId": "CVE-2023-31478", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2635d3be-5474-46ce-b8e1-85df1ffa1e7b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-03-31T18:23:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-31T18:23:23+00:00"}, "scope": {"notes": "Affected: GL.iNet / GL.iNet devices | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-31478", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31478"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "GL.iNet", "30d_avg": 1, "90d_avg": 2, "product": "GL.iNet devices", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "51483416-1742-4790-a350-83f6ff966c58", "vulnerability": {"vulnId": "CVE-2022-0769", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "51483416-1742-4790-a350-83f6ff966c58", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Users Ultra plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0769", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0769"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Users Ultra plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "129d1efb-b827-4b74-b637-6db6b1683813", "vulnerability": {"vulnId": "CVE-2022-22897", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "129d1efb-b827-4b74-b637-6db6b1683813", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-06T02:12:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-06T02:12:13+00:00"}, "scope": {"notes": "Affected: PrestaShop / PrestaShop ApolloTheme AP PageBuilder module | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22897", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22897"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "PrestaShop", "30d_avg": 6, "90d_avg": 4, "product": "PrestaShop ApolloTheme AP PageBuilder module", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "aa80ac3b-f36d-4788-a5ee-ee17b8b14e4f", "vulnerability": {"vulnId": "CVE-2021-46417", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aa80ac3b-f36d-4788-a5ee-ee17b8b14e4f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:20+00:00"}, "scope": {"notes": "Affected: Franklin Fueling Systems / Colibri Controller Module | Class: other-software | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-46417", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46417"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Franklin Fueling Systems", "30d_avg": 0, "90d_avg": 1, "product": "Colibri Controller Module", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8b6a7413-349d-46a6-9662-3e4a16057f31", "vulnerability": {"vulnId": "CVE-2022-43939", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8b6a7413-349d-46a6-9662-3e4a16057f31", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:40+00:00"}, "scope": {"notes": "Affected: Hitachi Vantara / Pentaho Business Analytics Server | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-43939", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43939"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hitachi Vantara", "30d_avg": 0, "90d_avg": 2, "product": "Pentaho Business Analytics Server", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0532e8e4-f362-4927-9132-0bb226aa7d21", "vulnerability": {"vulnId": "CVE-2021-39226", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0532e8e4-f362-4927-9132-0bb226aa7d21", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2023-10-14T14:57:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:13+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: other-software | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39226", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39226"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Grafana", "30d_avg": 0, "90d_avg": 1, "product": "Grafana", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "2773e1f8-d093-4afb-a4ae-a803bb71b2fd", "vulnerability": {"vulnId": "CVE-2022-24990", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2773e1f8-d093-4afb-a4ae-a803bb71b2fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Terramaster / TOS | Class: nas | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24990", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24990"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 2, "vendor": "Terramaster", "30d_avg": 3, "90d_avg": 3, "product": "TOS", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "27abe1b2-b630-49aa-b503-c060bee611f6", "vulnerability": {"vulnId": "CVE-2025-71284", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "27abe1b2-b630-49aa-b503-c060bee611f6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:17+00:00"}, "scope": {"notes": "Affected: Synway Information Engineering / Synway SMG Gateway Management Software | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-71284", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71284"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Synway Information Engineering", "30d_avg": 0, "90d_avg": 0, "product": "Synway SMG Gateway Management Software", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "639f9214-cd6b-4b17-9481-0c7bd0c87f12", "vulnerability": {"vulnId": "CVE-2025-8085", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "639f9214-cd6b-4b17-9481-0c7bd0c87f12", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-11-14T03:31:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-14T03:31:47+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Ditty plugin | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-8085", "url": "https://www.cve.org/CVERecord?id=CVE-2025-8085"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Ditty plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "9eb6568f-98a3-4f56-b87f-e67276c15ed2", "vulnerability": {"vulnId": "CVE-2019-11248", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9eb6568f-98a3-4f56-b87f-e67276c15ed2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2023-10-14T14:56:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:19+00:00"}, "scope": {"notes": "Affected: Kubernetes / Kubernetes (Kubelet) | Class: other-software | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11248", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11248"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Kubernetes", "30d_avg": 4, "90d_avg": 3, "product": "Kubernetes (Kubelet)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "bba22d9e-04b4-44cb-bcdf-a3a16efb7d52", "vulnerability": {"vulnId": "CVE-2023-26255", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bba22d9e-04b4-44cb-bcdf-a3a16efb7d52", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:46+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA STAGIL Navigation for Jira - Menu & Themes plugin | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26255", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26255"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 2, "product": "JIRA STAGIL Navigation for Jira - Menu & Themes plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "030bef2d-8546-4246-bf9f-b9168c1627eb", "vulnerability": {"vulnId": "CVE-2026-21891", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "030bef2d-8546-4246-bf9f-b9168c1627eb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-07T00:11:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-07T00:11:18+00:00"}, "scope": {"notes": "Affected: IceWhaleTech / ZimaOS | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-21891", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21891"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "IceWhaleTech", "30d_avg": 1, "90d_avg": 2, "product": "ZimaOS", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8f25e077-c910-479d-b351-92074fd7916c", "vulnerability": {"vulnId": "CVE-2020-14882", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f25e077-c910-479d-b351-92074fd7916c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:48:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:48:26+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-14882", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14882"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 1, "90d_avg": 2, "product": "Oracle Weblogic Server", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "edc97eb2-248b-4319-a518-6a5464123182", "vulnerability": {"vulnId": "CVE-2025-55190", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "edc97eb2-248b-4319-a518-6a5464123182", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2025-11-18T11:51:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-18T11:51:02+00:00"}, "scope": {"notes": "Affected: Argo Project / Argo CD | Class: other-software | Severity: Critical (CVSS 9.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-55190", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55190"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Argo Project", "30d_avg": 0, "90d_avg": 0, "product": "Argo CD", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "33a201c7-9c7b-476d-9c07-74d8b429b75d", "vulnerability": {"vulnId": "CVE-2021-36356", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "33a201c7-9c7b-476d-9c07-74d8b429b75d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:01+00:00"}, "scope": {"notes": "Affected: Kramer / VIAware | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2021-36356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Kramer", "30d_avg": 8, "90d_avg": 7, "product": "VIAware", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "18de4f5e-52b3-49fe-bb8f-c77b3f401dad", "vulnerability": {"vulnId": "CVE-2022-41840", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "18de4f5e-52b3-49fe-bb8f-c77b3f401dad", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Welcart eCommerce plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-41840", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41840"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Welcart eCommerce plugin", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d476cd36-d898-40a8-bd86-2bde23544df5", "vulnerability": {"vulnId": "CVE-2022-47966", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d476cd36-d898-40a8-bd86-2bde23544df5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:57:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:41+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine (multiple products) | Class: other-software | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-47966", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47966"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 2, "product": "ManageEngine (multiple products)", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "737c3f75-284e-4a13-912d-41a7f98cff89", "vulnerability": {"vulnId": "CVE-2023-1454", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "737c3f75-284e-4a13-912d-41a7f98cff89", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:42+00:00"}, "scope": {"notes": "Affected: JEECG / jeecg-boot | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1454", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1454"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "JEECG", "30d_avg": 1, "90d_avg": 2, "product": "jeecg-boot", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4d6d79a4-a79c-4dc2-929e-0e1398168f84", "vulnerability": {"vulnId": "CVE-2013-7091", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4d6d79a4-a79c-4dc2-929e-0e1398168f84", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-15T16:47:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T16:47:12+00:00"}, "scope": {"notes": "Affected: Synacor / Zimbra Collaboration Suite | Class: email | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2013-7091", "url": "https://www.cve.org/CVERecord?id=CVE-2013-7091"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Synacor", "30d_avg": 0, "90d_avg": 1, "product": "Zimbra Collaboration Suite", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "ffa60d6c-624a-4e3c-bb75-50324e4bbe11", "vulnerability": {"vulnId": "CVE-2020-17496", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ffa60d6c-624a-4e3c-bb75-50324e4bbe11", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:56:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:06+00:00"}, "scope": {"notes": "Affected: vBulletin / vBulletin | Class: cms | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17496", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17496"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 3, "vendor": "vBulletin", "30d_avg": 4, "90d_avg": 5, "product": "vBulletin", "cisa_kev": "yes", "connections": 24, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "929c0d80-34e5-4a6d-9986-b1e2d37eaa30", "vulnerability": {"vulnId": "EDB-28713", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "929c0d80-34e5-4a6d-9986-b1e2d37eaa30", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:24:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:24:42+00:00"}, "scope": {"notes": "Affected: RedHat / JBoss | Class: app-server | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-28713", "url": "https://www.exploit-db.com/exploits/28713"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "RedHat", "30d_avg": 5, "90d_avg": 3, "product": "JBoss", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "98fc5750-1fad-4e9f-b7ce-2b87a0bde698", "vulnerability": {"vulnId": "CVE-2020-16846", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "98fc5750-1fad-4e9f-b7ce-2b87a0bde698", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T00:28:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T00:28:16+00:00"}, "scope": {"notes": "Affected: SaltStack / Salt | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 23", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-16846", "url": "https://www.cve.org/CVERecord?id=CVE-2020-16846"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "SaltStack", "30d_avg": 2, "90d_avg": 5, "product": "Salt", "cisa_kev": "yes", "connections": 23, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "42715fd5-45a8-42a5-a69c-8ad5df98d0eb", "vulnerability": {"vulnId": "CVE-2017-9805", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "42715fd5-45a8-42a5-a69c-8ad5df98d0eb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-10-14T14:55:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:46+00:00"}, "scope": {"notes": "Affected: Apache / Struts | Class: web-app-framework | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 48", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-9805", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9805"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 2, "vendor": "Apache", "30d_avg": 6, "90d_avg": 4, "product": "Struts", "cisa_kev": "yes", "connections": 48, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "d2ea7cfe-4dc7-456f-b6c7-1250526dcd3c", "vulnerability": {"vulnId": "CVE-2019-5129", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d2ea7cfe-4dc7-456f-b6c7-1250526dcd3c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:54+00:00"}, "scope": {"notes": "Affected: YouPHPTube / YouPHPTube Encoder | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-5129", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5129"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "YouPHPTube", "30d_avg": 4, "90d_avg": 5, "product": "YouPHPTube Encoder", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fdcbcb01-f1bf-4709-adbb-a1890873fa0c", "vulnerability": {"vulnId": "CVE-2020-10173", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fdcbcb01-f1bf-4709-adbb-a1890873fa0c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-03-13T07:41:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-13T07:41:50+00:00"}, "scope": {"notes": "Affected: Comtrend / Comtrend VR-3033 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10173", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10173"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Comtrend", "30d_avg": 3, "90d_avg": 19, "product": "Comtrend VR-3033", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "3c5cb1fe-992f-4097-82a4-c417f56d374c", "vulnerability": {"vulnId": "CVE-2024-36401", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3c5cb1fe-992f-4097-82a4-c417f56d374c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-28T15:03:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-28T15:03:37+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2310", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-36401", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36401"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 4, "vendor": "Geoserver", "30d_avg": 3, "90d_avg": 2, "product": "Geoserver", "cisa_kev": "yes", "connections": 2310, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fc454d6d-3bc8-4d70-a0c1-beffd8e4ea79", "vulnerability": {"vulnId": "CVE-2019-9874", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fc454d6d-3bc8-4d70-a0c1-beffd8e4ea79", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T11:39:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T11:39:47+00:00"}, "scope": {"notes": "Affected: Sitecore / Sitecore CMS/XP | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9874", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Sitecore", "30d_avg": 1, "90d_avg": 2, "product": "Sitecore CMS/XP", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "027c1ed4-b1e5-40b6-8881-39c957057d92", "vulnerability": {"vulnId": "CVE-2025-25257", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "027c1ed4-b1e5-40b6-8881-39c957057d92", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-13T15:01:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-13T15:01:08+00:00"}, "scope": {"notes": "Affected: Fortinet / Fortinet FortiWeb | Class: firewall | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 60", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-25257", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25257"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Fortinet", "30d_avg": 1, "90d_avg": 2, "product": "Fortinet FortiWeb", "cisa_kev": "yes", "connections": 60, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "df40e333-4caf-4c4d-9ce9-ce971d30ca4b", "vulnerability": {"vulnId": "CVE-2023-27159", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "df40e333-4caf-4c4d-9ce9-ce971d30ca4b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:46+00:00"}, "scope": {"notes": "Affected: Appwrite / Appwrite | Class: web-app-framework | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27159", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27159"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Appwrite", "30d_avg": 0, "90d_avg": 1, "product": "Appwrite", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9d527e7e-af6c-4b38-96b1-35e0e2107215", "vulnerability": {"vulnId": "CVE-2018-10562", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9d527e7e-af6c-4b38-96b1-35e0e2107215", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:01:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:01:38+00:00"}, "scope": {"notes": "Affected: Dasan / Dasan GPON Home Router | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 468", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-10562", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10562"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "279", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 276, "vendor": "Dasan", "30d_avg": 299, "90d_avg": 428, "product": "Dasan GPON Home Router", "cisa_kev": "yes", "connections": 468, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4e8a2bcd-1ac2-406f-9e43-69780fe9e616", "vulnerability": {"vulnId": "CVE-2018-7600", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4e8a2bcd-1ac2-406f-9e43-69780fe9e616", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:52:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:52:42+00:00"}, "scope": {"notes": "Affected: Drupal / Drupal | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-7600", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7600"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Drupal", "30d_avg": 3, "90d_avg": 3, "product": "Drupal", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "332c2162-0965-4adc-8f82-ae8b34fa430f", "vulnerability": {"vulnId": "CVE-2021-46381", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "332c2162-0965-4adc-8f82-ae8b34fa430f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:19+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DAP-1620 | Class: wireless-extender | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-46381", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46381"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 2, "product": "D-Link DAP-1620", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9b8a9680-6913-4e1f-9308-d3136d97e4b7", "vulnerability": {"vulnId": "EDB-44760", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9b8a9680-6913-4e1f-9308-d3136d97e4b7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T22:17:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T22:17:07+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2750B | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 27", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-44760", "url": "https://www.exploit-db.com/exploits/44760"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "16", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 15, "vendor": "D-Link", "30d_avg": 49, "90d_avg": 112, "product": "D-Link DSL-2750B", "cisa_kev": "no", "connections": 27, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "76e94921-1d0e-4baa-aaa3-c191c81646fd", "vulnerability": {"vulnId": "CVE-2024-45195", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "76e94921-1d0e-4baa-aaa3-c191c81646fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-12-05T06:27:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:27+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 31", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-45195", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45195"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "OFBiz", "cisa_kev": "yes", "connections": 31, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3c98f710-9bb6-4523-a6ec-40fc8968423e", "vulnerability": {"vulnId": "EDB-48061", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3c98f710-9bb6-4523-a6ec-40fc8968423e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-19T01:15:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T01:15:15+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress wordfence plugin | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-48061", "url": "https://www.exploit-db.com/exploits/48061"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress wordfence plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "01a0508e-2638-4335-885d-91385395b480", "vulnerability": {"vulnId": "CVE-2022-33891", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "01a0508e-2638-4335-885d-91385395b480", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-11-24T01:57:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-24T01:57:15+00:00"}, "scope": {"notes": "Affected: Apache / Spark | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-33891", "url": "https://www.cve.org/CVERecord?id=CVE-2022-33891"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 1, "product": "Spark", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "8869ce58-688c-482a-b5eb-0691c4cf47b6", "vulnerability": {"vulnId": "CVE-2022-26134", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8869ce58-688c-482a-b5eb-0691c4cf47b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T18:19:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T18:19:11+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 141", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-26134", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26134"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "7", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 8, "vendor": "Atlassian", "30d_avg": 19, "90d_avg": 17, "product": "Confluence", "cisa_kev": "yes", "connections": 141, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "820a469c-25a3-4243-a6e9-241f46dddcf3", "vulnerability": {"vulnId": "CVE-2020-11546", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "820a469c-25a3-4243-a6e9-241f46dddcf3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:17+00:00"}, "scope": {"notes": "Affected: Mirko B\u00c3\u00b6er Software Development / SuperWebMailer | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11546"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "Mirko B\u00c3\u00b6er Software Development", "30d_avg": 1, "90d_avg": 2, "product": "SuperWebMailer", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f4fd4f59-8cbb-49e6-9c1d-de8e0bf64f34", "vulnerability": {"vulnId": "CVE-2014-8361", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f4fd4f59-8cbb-49e6-9c1d-de8e0bf64f34", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:03:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:03:28+00:00"}, "scope": {"notes": "Affected: Realtek / Realtek SDK | Class: embedded-system | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1247", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-8361", "url": "https://www.cve.org/CVERecord?id=CVE-2014-8361"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "301", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 294, "vendor": "Realtek", "30d_avg": 391, "90d_avg": 314, "product": "Realtek SDK", "cisa_kev": "yes", "connections": 1247, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a1085200-2c96-401e-a3cb-faa6b367ba21", "vulnerability": {"vulnId": "CVE-2020-8982", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a1085200-2c96-401e-a3cb-faa6b367ba21", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:42+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ShareFile StorageZones (aka storage zones) Controller | Class: app-delivery-controller | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8982", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8982"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 1, "product": "Citrix ShareFile StorageZones (aka storage zones) Controller", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "ea4cdf4b-2722-4160-8320-48db0f3b56f1", "vulnerability": {"vulnId": "CVE-2023-38646", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ea4cdf4b-2722-4160-8320-48db0f3b56f1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-13T16:00:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:19+00:00"}, "scope": {"notes": "Affected: Metabase / Metabase | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 587", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-38646", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38646"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "142", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 144, "vendor": "Metabase", "30d_avg": 146, "90d_avg": 132, "product": "Metabase", "cisa_kev": "no", "connections": 587, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "163fb203-8a00-4bb8-8e99-49b545f0f8a2", "vulnerability": {"vulnId": "CVE-2026-41940", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "163fb203-8a00-4bb8-8e99-49b545f0f8a2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T13:55:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-30T13:55:53+00:00"}, "scope": {"notes": "Affected: cPanel / cPanel and WHM | Class: remote-access | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 3047", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-41940", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41940"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "133", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 140, "vendor": "cPanel", "30d_avg": 231, "90d_avg": 262, "product": "cPanel and WHM", "cisa_kev": "yes", "connections": 3047, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0178849c-e816-458f-94ce-64a5ce57edee", "vulnerability": {"vulnId": "CVE-2022-29303", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0178849c-e816-458f-94ce-64a5ce57edee", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:29+00:00"}, "scope": {"notes": "Affected: CONTEC / SolarView Compact ver.6.00 | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29303", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29303"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "CONTEC", "30d_avg": 1, "90d_avg": 2, "product": "SolarView Compact ver.6.00", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1a3487c4-6f8a-4e49-963b-a371cf76b7db", "vulnerability": {"vulnId": "CVE-2025-5777", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1a3487c4-6f8a-4e49-963b-a371cf76b7db", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-02T10:06:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-02T10:06:43+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler | Class: app-delivery-controller | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 572", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-5777", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5777"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 4, "vendor": "Citrix", "30d_avg": 60, "90d_avg": 67, "product": "Citrix NetScaler", "cisa_kev": "yes", "connections": 572, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "ffd585cc-2e1d-4806-8fc5-72d77f5b945d", "vulnerability": {"vulnId": "CVE-2026-3055", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ffd585cc-2e1d-4806-8fc5-72d77f5b945d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-31T14:47:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-31T14:47:50+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler ADC and NetScaler Gateway | Class: app-delivery-controller | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 131", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-3055", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3055"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 11, "vendor": "Citrix", "30d_avg": 17, "90d_avg": 29, "product": "Citrix NetScaler ADC and NetScaler Gateway", "cisa_kev": "yes", "connections": 131, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "e35e11ea-acad-4db1-b133-5d49553f48e2", "vulnerability": {"vulnId": "CVE-2025-34057", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e35e11ea-acad-4db1-b133-5d49553f48e2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-10T07:08:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-10T07:08:23+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / Ruijie NBR routers | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34057", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34057"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 2, "90d_avg": 1, "product": "Ruijie NBR routers", "cisa_kev": "no", "connections": 13, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "96455fd3-7be3-4013-956d-4c4d155b5f09", "vulnerability": {"vulnId": "CVE-2022-35914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "96455fd3-7be3-4013-956d-4c4d155b5f09", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:36+00:00"}, "scope": {"notes": "Affected: GLPI (teclib) / GLPI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-35914", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 3, "vendor": "GLPI (teclib)", "30d_avg": 1, "90d_avg": 2, "product": "GLPI", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cc0ae999-92bf-4da5-8e88-41970eaa18ea", "vulnerability": {"vulnId": "CVE-2025-34059", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc0ae999-92bf-4da5-8e88-41970eaa18ea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T10:50:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T10:50:55+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua Intelligent Cloud Gateway Registration Management Platform | Class: device-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34059", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Dahua", "30d_avg": 1, "90d_avg": 1, "product": "Dahua Intelligent Cloud Gateway Registration Management Platform", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "19383d41-6a2d-443c-8fce-a12d550f8da6", "vulnerability": {"vulnId": "CVE-2025-12480", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "19383d41-6a2d-443c-8fce-a12d550f8da6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-26T14:32:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-26T14:32:22+00:00"}, "scope": {"notes": "Affected: Gladinet / Gladinet CentreStack & Triofox | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-12480", "url": "https://www.cve.org/CVERecord?id=CVE-2025-12480"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "Gladinet", "30d_avg": 1, "90d_avg": 2, "product": "Gladinet CentreStack & Triofox", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a374793e-1cb9-4ac8-abf8-84f7e9cea0ce", "vulnerability": {"vulnId": "CVE-2024-24919", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a374793e-1cb9-4ac8-abf8-84f7e9cea0ce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-05-31T15:47:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-05-31T15:47:40+00:00"}, "scope": {"notes": "Affected: Check Point / Check Point Security Gateway | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 40", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-24919", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24919"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 4, "vendor": "Check Point", "30d_avg": 10, "90d_avg": 10, "product": "Check Point Security Gateway", "cisa_kev": "yes", "connections": 40, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1c6d3144-62fe-433a-a6f4-ac60075d0d29", "vulnerability": {"vulnId": "CVE-2025-59287", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1c6d3144-62fe-433a-a6f4-ac60075d0d29", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-25T00:21:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-25T00:21:14+00:00"}, "scope": {"notes": "Affected: Microsoft / Windows Server Update Service | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-59287", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59287"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Microsoft", "30d_avg": 4, "90d_avg": 4, "product": "Windows Server Update Service", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "27027409-e86e-4d86-bda6-a69dcd9eea66", "vulnerability": {"vulnId": "CVE-2021-44228", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "27027409-e86e-4d86-bda6-a69dcd9eea66", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-13T17:58:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T17:58:35+00:00"}, "scope": {"notes": "Affected: Apache / Log4j | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 314", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-44228", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "23", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 30, "vendor": "Apache", "30d_avg": 37, "90d_avg": 45, "product": "Log4j", "cisa_kev": "yes", "connections": 314, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "bb9e9f3f-5b18-404c-8a40-5d58f490a28c", "vulnerability": {"vulnId": "CVE-2019-11580", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bb9e9f3f-5b18-404c-8a40-5d58f490a28c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-08T06:47:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-08T06:47:28+00:00"}, "scope": {"notes": "Affected: Atlassian / Crowd/Crowd Data Center | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11580", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11580"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "Atlassian", "30d_avg": 5, "90d_avg": 4, "product": "Crowd/Crowd Data Center", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5388cdd5-2363-4b7c-a33e-851e8b3c31fb", "vulnerability": {"vulnId": "CVE-2021-28799", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5388cdd5-2363-4b7c-a33e-851e8b3c31fb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-14T00:17:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-14T00:17:44+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP NAS running HBS 3 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-28799", "url": "https://www.cve.org/CVERecord?id=CVE-2021-28799"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "QNAP", "30d_avg": 1, "90d_avg": 2, "product": "QNAP NAS running HBS 3", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a73e833c-6418-47ef-88d9-a544f4dd3907", "vulnerability": {"vulnId": "CVE-2026-1603", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a73e833c-6418-47ef-88d9-a544f4dd3907", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-02-17T05:44:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-02-17T05:44:54+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1603", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1603"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 2, "90d_avg": 14, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "277e840b-f5cd-4826-ae8e-3123ec650b80", "vulnerability": {"vulnId": "CVE-2022-26138", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "277e840b-f5cd-4826-ae8e-3123ec650b80", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-26138", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26138"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Atlassian", "30d_avg": 2, "90d_avg": 11, "product": "Confluence", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f2e39f2c-cabc-46c9-96d9-eb5bb48dbc33", "vulnerability": {"vulnId": "CVE-2023-35082", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2e39f2c-cabc-46c9-96d9-eb5bb48dbc33", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T14:57:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:51+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35082", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35082"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 4, "vendor": "Ivanti", "30d_avg": 6, "90d_avg": 17, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "d3f17a6b-efb1-4a15-b6bb-fc447c14b4a8", "vulnerability": {"vulnId": "CVE-2023-49103", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d3f17a6b-efb1-4a15-b6bb-fc447c14b4a8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-11-26T14:09:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-26T14:09:20+00:00"}, "scope": {"notes": "Affected: ownCloud / ownCloud | Class: file-transfer | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-49103", "url": "https://www.cve.org/CVERecord?id=CVE-2023-49103"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "8", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 23, "vendor": "ownCloud", "30d_avg": 12, "90d_avg": 9, "product": "ownCloud", "cisa_kev": "yes", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "cec1ca4b-8e20-484b-9031-6a3c7ae6b408", "vulnerability": {"vulnId": "CVE-2020-5902", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cec1ca4b-8e20-484b-9031-6a3c7ae6b408", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: F5 / F5 Big-IP | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-5902", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5902"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 4, "vendor": "F5", "30d_avg": 10, "90d_avg": 6, "product": "F5 Big-IP", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e83f6046-1b61-4422-887e-ab15cc21bb15", "vulnerability": {"vulnId": "CVE-2020-24581", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e83f6046-1b61-4422-887e-ab15cc21bb15", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 80}, "timestamps": {"asserted_at": "2023-10-14T14:56:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:54+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2888A | Class: router | Severity: High (CVSS 8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-24581", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24581"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 5, "90d_avg": 4, "product": "D-Link DSL-2888A", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8, "vulnerability_severity": "High"}}]}
{"uuid": "3a871a1d-74e8-4d91-bdbe-32ad833dd262", "vulnerability": {"vulnId": "CVE-2024-0204", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3a871a1d-74e8-4d91-bdbe-32ad833dd262", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-25T08:15:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-25T08:15:17+00:00"}, "scope": {"notes": "Affected: Fortra / GoAnywhere MFT | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0204", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0204"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 4, "vendor": "Fortra", "30d_avg": 4, "90d_avg": 20, "product": "GoAnywhere MFT", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "516dccbd-64f2-4eed-90de-b7bcd57b5242", "vulnerability": {"vulnId": "CVE-2025-34039", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "516dccbd-64f2-4eed-90de-b7bcd57b5242", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-08T11:00:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-08T11:00:16+00:00"}, "scope": {"notes": "Affected: Yonyou / NC BeanShell | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34039", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34039"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Yonyou", "30d_avg": 2, "90d_avg": 1, "product": "NC BeanShell", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a4016307-8dab-4e4d-9ed7-4e85ad39c153", "vulnerability": {"vulnId": "CVE-2023-33831", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a4016307-8dab-4e4d-9ed7-4e85ad39c153", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:50+00:00"}, "scope": {"notes": "Affected: frangoteam / FUXA | Class: data-visualization | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-33831", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33831"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 1, "vendor": "frangoteam", "30d_avg": 6, "90d_avg": 4, "product": "FUXA", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "64a8fb1a-6157-408a-89e5-727303a62880", "vulnerability": {"vulnId": "CVE-2024-8963", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "64a8fb1a-6157-408a-89e5-727303a62880", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2024-11-06T19:17:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-06T19:17:38+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti CSA | Class: device-management-platform | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8963", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8963"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 4, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 7, "product": "Ivanti CSA", "cisa_kev": "yes", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "30c9602f-dfe1-4f30-af0a-07335e4ec895", "vulnerability": {"vulnId": "CVE-2023-7335", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "30c9602f-dfe1-4f30-af0a-07335e4ec895", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-01-23T21:27:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-23T21:27:44+00:00"}, "scope": {"notes": "Affected: Hangzhou Kuozhi Network Technology / EduSoho | Class: other-software | Severity: High (CVSS 8.7) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7335", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7335"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hangzhou Kuozhi Network Technology", "30d_avg": 1, "90d_avg": 1, "product": "EduSoho", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}]}
{"uuid": "d744e240-62ed-45fd-ac7c-f4ef59a2c4f9", "vulnerability": {"vulnId": "CVE-2023-35813", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d744e240-62ed-45fd-ac7c-f4ef59a2c4f9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-28T18:07:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-28T18:07:30+00:00"}, "scope": {"notes": "Affected: Sitecore / Experience Manager, Experience Platform, and Experience Commerce | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35813", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35813"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Sitecore", "30d_avg": 1, "90d_avg": 2, "product": "Experience Manager, Experience Platform, and Experience Commerce", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "981ade6b-bc7a-41f3-98b9-1f9e543725fd", "vulnerability": {"vulnId": "CVE-2021-37580", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "981ade6b-bc7a-41f3-98b9-1f9e543725fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:02+00:00"}, "scope": {"notes": "Affected: Apache / ShenYu | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 28", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-37580", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37580"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "ShenYu", "cisa_kev": "no", "connections": 28, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6cabac86-4450-43fe-9f3a-146bc5b51c5d", "vulnerability": {"vulnId": "CVE-2020-15505", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6cabac86-4450-43fe-9f3a-146bc5b51c5d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:51:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T15:51:12+00:00"}, "scope": {"notes": "Affected: MobileIron / MobileIron Mobile Device Management (MDM) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15505", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15505"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "MobileIron", "30d_avg": 4, "90d_avg": 9, "product": "MobileIron Mobile Device Management (MDM)", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0b25781a-e632-4e30-bf8b-302346c5e2fc", "vulnerability": {"vulnId": "CVE-2020-7796", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0b25781a-e632-4e30-bf8b-302346c5e2fc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:40+00:00"}, "scope": {"notes": "Affected: Zimbra / Zimbra Collaboration Suite | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-7796", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7796"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Zimbra", "30d_avg": 1, "90d_avg": 2, "product": "Zimbra Collaboration Suite", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "23d46b96-d9fa-4996-9a19-0e428c7d7592", "vulnerability": {"vulnId": "CVE-2019-12593", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "23d46b96-d9fa-4996-9a19-0e428c7d7592", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:02+00:00"}, "scope": {"notes": "Affected: IceWarp / IceWarp Mail Server | Class: email | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12593", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12593"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "IceWarp", "30d_avg": 5, "90d_avg": 4, "product": "IceWarp Mail Server", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1567108d-a94c-4545-8b2a-f20779290b05", "vulnerability": {"vulnId": "CVE-2020-25506", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1567108d-a94c-4545-8b2a-f20779290b05", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T17:47:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T17:47:42+00:00"}, "scope": {"notes": "Affected: D-Link / DNS-320 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-25506", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25506"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 2, "vendor": "D-Link", "30d_avg": 6, "90d_avg": 5, "product": "DNS-320", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "81257814-f6d0-4b01-afea-aa54e34d361f", "vulnerability": {"vulnId": "CVE-2021-35587", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "81257814-f6d0-4b01-afea-aa54e34d361f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:00+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Access Manager (Oracle Fusion Middleware) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35587", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35587"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Oracle", "30d_avg": 3, "90d_avg": 3, "product": "Oracle Access Manager (Oracle Fusion Middleware)", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bde05480-5458-40a5-b188-7adb63a97da0", "vulnerability": {"vulnId": "CVE-2024-21893", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bde05480-5458-40a5-b188-7adb63a97da0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2024-02-03T01:58:22+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-03T01:58:22+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Connect Secure, Policy Secure and Ivanti Neurons for ZTA | Class: vpn | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21893", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21893"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 1, "90d_avg": 1, "product": "Ivanti Connect Secure, Policy Secure and Ivanti Neurons for ZTA", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "3d00d3a7-53dc-49d5-98e4-541ef32f8a9e", "vulnerability": {"vulnId": "CVE-2023-46805", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3d00d3a7-53dc-49d5-98e4-541ef32f8a9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 31}, "timestamps": {"asserted_at": "2024-01-18T00:33:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-18T00:33:51+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti Secure Connect and Policy Secure | Class: vpn | Severity: Low (CVSS 3.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 21", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-46805", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46805"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 4, "vendor": "Ivanti", "30d_avg": 6, "90d_avg": 4, "product": "Ivanti Secure Connect and Policy Secure", "cisa_kev": "yes", "connections": 21, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 3.1, "vulnerability_severity": "Low"}}]}
{"uuid": "cc556a07-e13b-4b5b-8c8f-edae8649d61f", "vulnerability": {"vulnId": "CVE-2023-30258", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc556a07-e13b-4b5b-8c8f-edae8649d61f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-28T18:07:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-28T18:07:19+00:00"}, "scope": {"notes": "Affected: MagnusSolution / magnusbilling | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-30258", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30258"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "MagnusSolution", "30d_avg": 6, "90d_avg": 4, "product": "magnusbilling", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ac95d30-8475-4275-bfb1-25efbe583c21", "vulnerability": {"vulnId": "CVE-2021-38647", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ac95d30-8475-4275-bfb1-25efbe583c21", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:57:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:02+00:00"}, "scope": {"notes": "Affected: Microsoft / Open Management Infrastructure (OMI) | Class: device-management-platform | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-38647", "url": "https://www.cve.org/CVERecord?id=CVE-2021-38647"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Microsoft", "30d_avg": 1, "90d_avg": 2, "product": "Open Management Infrastructure (OMI)", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "b8c93f34-0989-4b09-b36a-c3ca9bf4962b", "vulnerability": {"vulnId": "CVE-2022-24112", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b8c93f34-0989-4b09-b36a-c3ca9bf4962b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:27+00:00"}, "scope": {"notes": "Affected: Apache / APISIX | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 32", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24112", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24112"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 4, "90d_avg": 4, "product": "APISIX", "cisa_kev": "yes", "connections": 32, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b60a6eb2-5b76-48f5-8a3c-76d8219655ac", "vulnerability": {"vulnId": "CVE-2020-7209", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b60a6eb2-5b76-48f5-8a3c-76d8219655ac", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:39+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:39+00:00"}, "scope": {"notes": "Affected: HPE / LinuxKI | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-7209", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7209"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 3, "vendor": "HPE", "30d_avg": 2, "90d_avg": 3, "product": "LinuxKI", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "28d678c8-0974-48d3-bfa9-ba25da402781", "vulnerability": {"vulnId": "CVE-2017-14135", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "28d678c8-0974-48d3-bfa9-ba25da402781", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:18:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:18:28+00:00"}, "scope": {"notes": "Affected: OpenDreamBox / Plugin WebAdmin | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-14135", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14135"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 1, "vendor": "OpenDreamBox", "30d_avg": 1, "90d_avg": 2, "product": "Plugin WebAdmin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "26557ea7-95b7-422d-bd5c-c14b4b9b218a", "vulnerability": {"vulnId": "CVE-2020-9054", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "26557ea7-95b7-422d-bd5c-c14b4b9b218a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:43+00:00"}, "scope": {"notes": "Affected: ZyXEL / ZyXEL NAS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-9054", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 2, "vendor": "ZyXEL", "30d_avg": 3, "90d_avg": 3, "product": "ZyXEL NAS", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5ccad099-509e-48a9-92f8-69bede116dca", "vulnerability": {"vulnId": "CVE-2020-5847", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5ccad099-509e-48a9-92f8-69bede116dca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:38+00:00"}, "scope": {"notes": "Affected: Lime Technology / Unraid | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-5847", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5847"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Lime Technology", "30d_avg": 3, "90d_avg": 3, "product": "Unraid", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "13e22eb1-9350-4d21-b4a1-174aa4ac88a2", "vulnerability": {"vulnId": "CVE-2022-36509", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "13e22eb1-9350-4d21-b4a1-174aa4ac88a2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 78}, "timestamps": {"asserted_at": "2023-12-04T17:07:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-04T17:07:58+00:00"}, "scope": {"notes": "Affected: H3C / H3C GR3200 | Class: router | Severity: High (CVSS 7.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36509", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36509"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "H3C", "30d_avg": 3, "90d_avg": 3, "product": "H3C GR3200", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.8, "vulnerability_severity": "High"}}]}
{"uuid": "9aef750a-5c82-49b1-8eb0-eb822ddb41d6", "vulnerability": {"vulnId": "CVE-2020-29597", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9aef750a-5c82-49b1-8eb0-eb822ddb41d6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:37+00:00"}, "scope": {"notes": "Affected: IncomCMS / IncomCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-29597", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29597"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "IncomCMS", "30d_avg": 2, "90d_avg": 2, "product": "IncomCMS", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "df7f5bf7-b963-4e16-baae-26bc79a26682", "vulnerability": {"vulnId": "CVE-2019-11581", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "df7f5bf7-b963-4e16-baae-26bc79a26682", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T18:05:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T18:05:55+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11581", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11581"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 2, "product": "JIRA", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "412b6d25-f3ec-46b3-8e65-2692ddcc9324", "vulnerability": {"vulnId": "CVE-2014-3206", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "412b6d25-f3ec-46b3-8e65-2692ddcc9324", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:11:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:11:46+00:00"}, "scope": {"notes": "Affected: Seagate / BlackArmor NAS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 279", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-3206", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3206"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "Seagate", "30d_avg": 5, "90d_avg": 4, "product": "BlackArmor NAS", "cisa_kev": "no", "connections": 279, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2b3f620a-1c60-4f7a-b846-374a6bd92f86", "vulnerability": {"vulnId": "CVE-2016-1555", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2b3f620a-1c60-4f7a-b846-374a6bd92f86", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:14:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:14:43+00:00"}, "scope": {"notes": "Affected: NETGEAR / WN604, WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-1555", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1555"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "NETGEAR", "30d_avg": 8, "90d_avg": 4, "product": "WN604, WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b6cc24f9-665e-42b3-8715-3eb1b0d6dc72", "vulnerability": {"vulnId": "CVE-2023-2523", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b6cc24f9-665e-42b3-8715-3eb1b0d6dc72", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:12:02+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-13T13:12:02+00:00"}, "scope": {"notes": "Affected: Weaver / Weave E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-2523", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2523"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weave E-Office", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "661aba68-3148-4e93-85cc-440236136dff", "vulnerability": {"vulnId": "CVE-2024-53704", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "661aba68-3148-4e93-85cc-440236136dff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2025-02-24T19:28:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-24T19:28:16+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicOS | Class: firewall | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-53704", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53704"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "SonicWall", "30d_avg": 3, "90d_avg": 3, "product": "SonicOS", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}]}
{"uuid": "cc42304d-59a9-4232-bf05-a710b4a36cd3", "vulnerability": {"vulnId": "CVE-2021-35395", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc42304d-59a9-4232-bf05-a710b4a36cd3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-01T07:54:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-01T07:54:50+00:00"}, "scope": {"notes": "Affected: Realtek / Realtek SDK | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35395", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35395"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 2, "vendor": "Realtek", "30d_avg": 3, "90d_avg": 3, "product": "Realtek SDK", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ee180f7e-e947-45e9-a585-19fc857e11f2", "vulnerability": {"vulnId": "CVE-2021-21234", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ee180f7e-e947-45e9-a585-19fc857e11f2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 77}, "timestamps": {"asserted_at": "2023-10-14T14:56:47+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:47+00:00"}, "scope": {"notes": "Affected: Spring Boot Actuator Logview / Spring Boot Actuator Logview | Class: other-software | Severity: High (CVSS 7.7) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21234", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21234"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Spring Boot Actuator Logview", "30d_avg": 5, "90d_avg": 4, "product": "Spring Boot Actuator Logview", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.7, "vulnerability_severity": "High"}}]}
{"uuid": "cc21926e-2250-4c20-9f6e-6cf1e393553e", "vulnerability": {"vulnId": "CVE-2022-39986", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc21926e-2250-4c20-9f6e-6cf1e393553e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:38+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:38+00:00"}, "scope": {"notes": "Affected: RaspAP / RaspAP | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-39986", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39986"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "RaspAP", "30d_avg": 1, "90d_avg": 2, "product": "RaspAP", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9977bf53-c0c8-4461-8fa4-c172ae5d7748", "vulnerability": {"vulnId": "CVE-2024-6220", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9977bf53-c0c8-4461-8fa4-c172ae5d7748", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-17T23:00:31+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-17T23:00:31+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Keydatas plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6220", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6220"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress Keydatas plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "27f8103b-6e81-4aa8-a9f1-9da81d2fad73", "vulnerability": {"vulnId": "CVE-2023-1177", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "27f8103b-6e81-4aa8-a9f1-9da81d2fad73", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T19:47:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T19:47:04+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1177", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1177"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "MLflow", "30d_avg": 9, "90d_avg": 7, "product": "MLflow", "cisa_kev": "no", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ca72b103-42bc-47ae-8ca6-33afe0f0dd49", "vulnerability": {"vulnId": "CVE-2020-4427", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ca72b103-42bc-47ae-8ca6-33afe0f0dd49", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-12T11:56:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-12T11:56:35+00:00"}, "scope": {"notes": "Affected: IBM / IBM Data Risk Manager | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-4427", "url": "https://www.cve.org/CVERecord?id=CVE-2020-4427"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "IBM", "30d_avg": 2, "90d_avg": 3, "product": "IBM Data Risk Manager", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0dbc0e55-fa90-42c4-9822-715313766dbd", "vulnerability": {"vulnId": "CVE-2021-21975", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0dbc0e55-fa90-42c4-9822-715313766dbd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:48+00:00"}, "scope": {"notes": "Affected: VMware / vRealize Operations Manager API | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21975", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21975"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "VMware", "30d_avg": 1, "90d_avg": 2, "product": "vRealize Operations Manager API", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "383c69ab-4bd8-4eec-b766-0eff22bf1ac6", "vulnerability": {"vulnId": "CVE-2024-13159", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "383c69ab-4bd8-4eec-b766-0eff22bf1ac6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-11T22:37:23+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-11T22:37:23+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13159", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13159"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 4, "90d_avg": 3, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cd2719bd-852f-497f-b8df-d54ef5bf50d3", "vulnerability": {"vulnId": "CVE-2022-0948", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cd2719bd-852f-497f-b8df-d54ef5bf50d3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T19:10:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-09T19:10:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Order Listener for WooCommerce WordPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0948", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0948"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Wordpress Order Listener for WooCommerce WordPress plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "aea6d1e3-aa0f-4214-8dd3-eccbdb813389", "vulnerability": {"vulnId": "CVE-2023-35844", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aea6d1e3-aa0f-4214-8dd3-eccbdb813389", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-11-26T19:03:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-26T19:03:04+00:00"}, "scope": {"notes": "Affected: Lightdash / Lightdash | Class: business-intelligence | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35844", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35844"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 0, "vendor": "Lightdash", "30d_avg": 0, "90d_avg": 1, "product": "Lightdash", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "dfa78234-1e08-48cf-a5f8-b189995e1f93", "vulnerability": {"vulnId": "CVE-2020-8209", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dfa78234-1e08-48cf-a5f8-b189995e1f93", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:41+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:41+00:00"}, "scope": {"notes": "Affected: Citrix  / XenMobile Server | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8209", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8209"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Citrix ", "30d_avg": 0, "90d_avg": 2, "product": "XenMobile Server", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "58aa2120-5485-4c2d-a39a-89e5922684c7", "vulnerability": {"vulnId": "CVE-2024-28255", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "58aa2120-5485-4c2d-a39a-89e5922684c7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-20T22:28:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-20T22:28:14+00:00"}, "scope": {"notes": "Affected: OpenMetadata / OpenMetadata | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-28255", "url": "https://www.cve.org/CVERecord?id=CVE-2024-28255"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "OpenMetadata", "30d_avg": 1, "90d_avg": 2, "product": "OpenMetadata", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "dc13d448-266e-4de7-84e5-c4f80690d6d0", "vulnerability": {"vulnId": "CVE-2019-13372", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dc13d448-266e-4de7-84e5-c4f80690d6d0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-10T15:47:48+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-10T15:47:48+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link Central WiFi Manager CWM(100) | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-13372", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13372"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link Central WiFi Manager CWM(100)", "cisa_kev": "no", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "970ca505-a6af-4ac6-aa93-a1efbc64b247", "vulnerability": {"vulnId": "CVE-2022-25487", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "970ca505-a6af-4ac6-aa93-a1efbc64b247", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: The Digital Craft / AtomCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25487", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25487"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "The Digital Craft", "30d_avg": 5, "90d_avg": 4, "product": "AtomCMS", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "db60e281-ede0-4189-aaa7-f2b70f35b6d5", "vulnerability": {"vulnId": "CVE-2021-44868", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "db60e281-ede0-4189-aaa7-f2b70f35b6d5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:56:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-10T16:56:05+00:00"}, "scope": {"notes": "Affected: ming-soft / MCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-44868", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44868"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "ming-soft", "30d_avg": 5, "90d_avg": 4, "product": "MCMS", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0ab46cb6-d5dd-4a30-b226-fa790552237c", "vulnerability": {"vulnId": "CVE-2024-41713", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0ab46cb6-d5dd-4a30-b226-fa790552237c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2024-12-11T23:12:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-12-11T23:12:34+00:00"}, "scope": {"notes": "Affected: Mitel / MiCollab | Class: voip | Severity: Critical (CVSS 9.1) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 16", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-41713", "url": "https://www.cve.org/CVERecord?id=CVE-2024-41713"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 1, "vendor": "Mitel", "30d_avg": 3, "90d_avg": 6, "product": "MiCollab", "cisa_kev": "yes", "connections": 16, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "fcc883e3-d986-408c-8a01-3dc0702f3ac0", "vulnerability": {"vulnId": "CVE-2023-32117", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fcc883e3-d986-408c-8a01-3dc0702f3ac0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-26T08:35:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-26T08:35:58+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress SoftLab Integrate Google Drive | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-32117", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32117"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress SoftLab Integrate Google Drive", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7320f456-bd41-44c9-b627-7f4f0ead1225", "vulnerability": {"vulnId": "CVE-2022-26352", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7320f456-bd41-44c9-b627-7f4f0ead1225", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: dotCMS / dotCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-26352", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26352"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "dotCMS", "30d_avg": 5, "90d_avg": 4, "product": "dotCMS", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b2601813-1a1b-445e-8cbc-5921b756cf1c", "vulnerability": {"vulnId": "CVE-2022-3801", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b2601813-1a1b-445e-8cbc-5921b756cf1c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:37+00:00"}, "scope": {"notes": "Affected: IBAX / go-ibax | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-3801", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3801"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "IBAX", "30d_avg": 1, "90d_avg": 2, "product": "go-ibax", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "f8a2350d-7fa6-472c-aebc-b0f715f90eef", "vulnerability": {"vulnId": "CVE-2024-27348", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8a2350d-7fa6-472c-aebc-b0f715f90eef", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-15T11:45:32+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-15T11:45:32+00:00"}, "scope": {"notes": "Affected: Apache / HugeGraph | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27348", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27348"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "HugeGraph", "cisa_kev": "yes", "connections": 33, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "efa7dc9f-1505-40a8-9444-7a286caf6867", "vulnerability": {"vulnId": "CVE-2020-11978", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "efa7dc9f-1505-40a8-9444-7a286caf6867", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:52+00:00"}, "scope": {"notes": "Affected: Apache / Airflow | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 32", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11978", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11978"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 5, "90d_avg": 4, "product": "Airflow", "cisa_kev": "yes", "connections": 32, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "8880d6f5-3bbe-4752-802c-e54bc0869525", "vulnerability": {"vulnId": "CVE-2026-23744", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8880d6f5-3bbe-4752-802c-e54bc0869525", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2026-03-07T00:11:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-03-07T00:11:29+00:00"}, "scope": {"notes": "Affected: MCPJam / MCPJam Inspector | Class: ai-system | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-23744", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23744"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "MCPJam", "30d_avg": 0, "90d_avg": 1, "product": "MCPJam Inspector", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "33065995-37f2-450b-ada1-23d01989cfc1", "vulnerability": {"vulnId": "CVE-2023-6023", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "33065995-37f2-450b-ada1-23d01989cfc1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-11T17:53:07+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-11T17:53:07+00:00"}, "scope": {"notes": "Affected: VertaAI / ModelDB | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6023", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6023"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VertaAI", "30d_avg": 0, "90d_avg": 2, "product": "ModelDB", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "6bd5e685-ec75-4db5-ba62-e321a9fb46a2", "vulnerability": {"vulnId": "CVE-2023-3836", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6bd5e685-ec75-4db5-ba62-e321a9fb46a2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T20:33:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:33:36+00:00"}, "scope": {"notes": "Affected: Dahua / Smart Park Management | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3836", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3836"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Dahua", "30d_avg": 5, "90d_avg": 4, "product": "Smart Park Management", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ed1c70c8-11ff-4723-9101-6e002ce6a1bf", "vulnerability": {"vulnId": "CVE-2025-34022", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ed1c70c8-11ff-4723-9101-6e002ce6a1bf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-29T17:29:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-29T17:29:16+00:00"}, "scope": {"notes": "Affected: Selea / Selea Targa IP OCR-ANPR Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34022", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34022"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Selea", "30d_avg": 0, "90d_avg": 0, "product": "Selea Targa IP OCR-ANPR Camera", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e09bc4f6-8146-4e97-a3e5-ec5553e23614", "vulnerability": {"vulnId": "CVE-2022-28079", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e09bc4f6-8146-4e97-a3e5-ec5553e23614", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:57:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:28+00:00"}, "scope": {"notes": "Affected: College Management System / College Management System v1.0 | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28079", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28079"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "College Management System", "30d_avg": 1, "90d_avg": 2, "product": "College Management System v1.0", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "110c8ceb-c285-41d5-828a-ad7145da47db", "vulnerability": {"vulnId": "CVE-2020-11530", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "110c8ceb-c285-41d5-828a-ad7145da47db", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-27T04:52:24+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-04-27T04:52:24+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Chop Slider plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11530", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11530"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Chop Slider plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "91772f11-40c6-41e0-a380-1465689c4a39", "vulnerability": {"vulnId": "CVE-2022-37042", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "91772f11-40c6-41e0-a380-1465689c4a39", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:03:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-13T16:03:52+00:00"}, "scope": {"notes": "Affected: Synacor / Zimbra Collaboration Suite | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-37042", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37042"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 3, "vendor": "Synacor", "30d_avg": 10, "90d_avg": 10, "product": "Zimbra Collaboration Suite", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cd4b5db2-80e2-4cd2-b9a5-55964e9f39ab", "vulnerability": {"vulnId": "CVE-2018-15138", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cd4b5db2-80e2-4cd2-b9a5-55964e9f39ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:19+00:00"}, "scope": {"notes": "Affected: Ericsson-LG / iPECS NMS 30M | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-15138", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15138"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Ericsson-LG", "30d_avg": 5, "90d_avg": 3, "product": "iPECS NMS 30M", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "22e3c847-8b8f-4077-bae2-534a6eafe0af", "vulnerability": {"vulnId": "CVE-2023-49070", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "22e3c847-8b8f-4077-bae2-534a6eafe0af", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-28T18:07:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-28T18:07:49+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-49070", "url": "https://www.cve.org/CVERecord?id=CVE-2023-49070"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "OFBiz", "cisa_kev": "no", "connections": 33, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eab497f5-cb1e-4f5a-bf0b-edbe344fdad9", "vulnerability": {"vulnId": "CVE-2021-40875", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eab497f5-cb1e-4f5a-bf0b-edbe344fdad9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-08-18T07:58:09+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-08-18T07:58:09+00:00"}, "scope": {"notes": "Affected: Gurock (Sembi) / TestRail | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-40875", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40875"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Gurock (Sembi)", "30d_avg": 5, "90d_avg": 4, "product": "TestRail", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c16292ec-c29b-45f2-aa69-f122737404dc", "vulnerability": {"vulnId": "CVE-2023-20198", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c16292ec-c29b-45f2-aa69-f122737404dc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-19T04:13:16+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T04:13:16+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco IOS XE | Class: router | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 1634", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-20198", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20198"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "171", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 167, "vendor": "Cisco", "30d_avg": 218, "90d_avg": 218, "product": "Cisco IOS XE", "cisa_kev": "yes", "connections": 1634, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "0b492439-9bbc-4d4f-be18-423cd92c558e", "vulnerability": {"vulnId": "CVE-2018-17173", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0b492439-9bbc-4d4f-be18-423cd92c558e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-11-15T09:26:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-15T09:26:21+00:00"}, "scope": {"notes": "Affected: LG / SuperSign CMS | Class: cms | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 29", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-17173", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17173"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "LG", "30d_avg": 1, "90d_avg": 2, "product": "SuperSign CMS", "cisa_kev": "no", "connections": 29, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "163026e1-0650-4943-8b1a-b8671119725c", "vulnerability": {"vulnId": "CVE-2024-38289", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "163026e1-0650-4943-8b1a-b8671119725c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-14T12:28:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-09-14T12:28:14+00:00"}, "scope": {"notes": "Affected: R-HUB / TurboMeeting | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-38289", "url": "https://www.cve.org/CVERecord?id=CVE-2024-38289"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "R-HUB", "30d_avg": 5, "90d_avg": 4, "product": "TurboMeeting", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5cf96493-a683-4e0b-9f10-d268b58848f5", "vulnerability": {"vulnId": "CVE-2024-9465", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5cf96493-a683-4e0b-9f10-d268b58848f5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2024-11-13T13:52:55+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-11-13T13:52:55+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / Palo Alto Networks Expedition | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9465", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9465"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Palo Alto Networks", "30d_avg": 1, "90d_avg": 2, "product": "Palo Alto Networks Expedition", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "91b1a982-7e0b-4206-831b-1ff3b58b0231", "vulnerability": {"vulnId": "CVE-2021-24499", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "91b1a982-7e0b-4206-831b-1ff3b58b0231", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:51+00:00"}, "scope": {"notes": "Affected: Wordpress / Workreap Wordpress theme | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24499", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24499"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "Workreap Wordpress theme", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "82022b22-4cb0-4005-8d62-948ca744b48d", "vulnerability": {"vulnId": "CVE-2021-22986", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "82022b22-4cb0-4005-8d62-948ca744b48d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:50+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22986", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22986"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 3, "vendor": "F5", "30d_avg": 14, "90d_avg": 10, "product": "BIG-IP", "cisa_kev": "yes", "connections": 17, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7e1ec519-e81f-4d18-958c-2aaeec2470b2", "vulnerability": {"vulnId": "CVE-2021-43778", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7e1ec519-e81f-4d18-958c-2aaeec2470b2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:15+00:00"}, "scope": {"notes": "Affected: Barcode / Barcode (GLPI plugin) | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-43778", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43778"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Barcode", "30d_avg": 0, "90d_avg": 1, "product": "Barcode (GLPI plugin)", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9f160168-a15b-4402-8492-f44b7918375a", "vulnerability": {"vulnId": "CVE-2020-13117", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9f160168-a15b-4402-8492-f44b7918375a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:20+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN575A4 and WN579X3 | Class: wireless-extender | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13117", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13117"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 1, "vendor": "WAVLINK", "30d_avg": 1, "90d_avg": 2, "product": "WAVLINK WN575A4 and WN579X3", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e030fc63-e9bc-49ce-9fa8-045e2382d22b", "vulnerability": {"vulnId": "CVE-2025-34048", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e030fc63-e9bc-49ce-9fa8-045e2382d22b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-29T17:09:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-29T17:09:04+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2730U/2750U/2750E | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34048", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34048"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 2, "product": "D-Link DSL-2730U/2750U/2750E", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "373a0b6c-a383-47a7-8e89-cc76afc3c99d", "vulnerability": {"vulnId": "CVE-2017-15363", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "373a0b6c-a383-47a7-8e89-cc76afc3c99d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:55:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:25+00:00"}, "scope": {"notes": "Affected: Luracast / Luracast Restler | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-15363", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15363"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Luracast", "30d_avg": 0, "90d_avg": 1, "product": "Luracast Restler", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5e060941-2b36-4c30-aab3-c448d13fe297", "vulnerability": {"vulnId": "CVE-2021-22005", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5e060941-2b36-4c30-aab3-c448d13fe297", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:13+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:13+00:00"}, "scope": {"notes": "Affected: VMware / vCenter | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22005", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22005"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VMware", "30d_avg": 4, "90d_avg": 3, "product": "vCenter", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ae9fcef-cfcb-4492-a48c-ba5b3e0f3c99", "vulnerability": {"vulnId": "CVE-2019-13462", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ae9fcef-cfcb-4492-a48c-ba5b3e0f3c99", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2025-01-22T16:27:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:27:29+00:00"}, "scope": {"notes": "Affected: Lansweeper / Lansweeper | Class: device-management-platform | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-13462", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13462"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Lansweeper", "30d_avg": 0, "90d_avg": 1, "product": "Lansweeper", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "77e4ec0c-4ddb-459f-ab86-bbae2d4296f3", "vulnerability": {"vulnId": "CVE-2024-6235", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "77e4ec0c-4ddb-459f-ab86-bbae2d4296f3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-10-25T19:23:19+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-10-25T19:23:19+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler Console | Class: device-management-platform | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6235", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6235"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 1, "90d_avg": 2, "product": "Citrix NetScaler Console", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "69397957-4b6a-454c-b7c1-603a2a032c0e", "vulnerability": {"vulnId": "CVE-2021-45092", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "69397957-4b6a-454c-b7c1-603a2a032c0e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:51:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:51:59+00:00"}, "scope": {"notes": "Affected: Cybele Software / Thinfinity VirtualUI | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-45092", "url": "https://www.cve.org/CVERecord?id=CVE-2021-45092"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Cybele Software", "30d_avg": 0, "90d_avg": 1, "product": "Thinfinity VirtualUI", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c332c7e5-2fdd-48d3-99bd-87b9435253c9", "vulnerability": {"vulnId": "CVE-2023-51467", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c332c7e5-2fdd-48d3-99bd-87b9435253c9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-03T14:20:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-01-03T14:20:20+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 30", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-51467", "url": "https://www.cve.org/CVERecord?id=CVE-2023-51467"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "OFBiz", "cisa_kev": "no", "connections": 30, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c428f4df-4d40-4055-b625-71bad5d9de90", "vulnerability": {"vulnId": "CVE-2023-25573", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c428f4df-4d40-4055-b625-71bad5d9de90", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:45+00:00"}, "scope": {"notes": "Affected: metersphere / metersphere | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-25573", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25573"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "metersphere", "30d_avg": 1, "90d_avg": 2, "product": "metersphere", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2bde9ed9-0203-4f74-b5f9-b4215fa7a74c", "vulnerability": {"vulnId": "CVE-2023-36934", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2bde9ed9-0203-4f74-b5f9-b4215fa7a74c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T14:57:52+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:52+00:00"}, "scope": {"notes": "Affected: Progress / MOVEit Transfer | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-36934", "url": "https://www.cve.org/CVERecord?id=CVE-2023-36934"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Progress", "30d_avg": 4, "90d_avg": 4, "product": "MOVEit Transfer", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "c2fa95dd-2cbf-499d-b2c9-bf2f52ba122d", "vulnerability": {"vulnId": "CVE-2022-47075", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c2fa95dd-2cbf-499d-b2c9-bf2f52ba122d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-05-12T23:29:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-12T23:29:25+00:00"}, "scope": {"notes": "Affected: Smart Office Payroll / Smart Office Web | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-47075", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47075"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Smart Office Payroll", "30d_avg": 1, "90d_avg": 2, "product": "Smart Office Web", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "9560213c-ec4a-4249-b3b0-91e236ade437", "vulnerability": {"vulnId": "CVE-2019-15107", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9560213c-ec4a-4249-b3b0-91e236ade437", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:04+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:04+00:00"}, "scope": {"notes": "Affected: Webmin / Webmin | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-15107", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15107"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Webmin", "30d_avg": 2, "90d_avg": 2, "product": "Webmin", "cisa_kev": "yes", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fdc54d95-dee4-4e13-a653-b85634af8a9a", "vulnerability": {"vulnId": "CVE-2024-13160", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fdc54d95-dee4-4e13-a653-b85634af8a9a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-11T05:59:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-03-11T05:59:26+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13160", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13160"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 3, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cf8b4a42-13d4-48d7-9a45-f143d5d82079", "vulnerability": {"vulnId": "CVE-2025-34041", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cf8b4a42-13d4-48d7-9a45-f143d5d82079", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T08:38:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T08:38:28+00:00"}, "scope": {"notes": "Affected: Sangfor / Sangfor EDR | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34041", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34041"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Sangfor", "30d_avg": 0, "90d_avg": 0, "product": "Sangfor EDR", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "705bb2ff-06e8-429f-9a8c-02849319a472", "vulnerability": {"vulnId": "CVE-2019-18952", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "705bb2ff-06e8-429f-9a8c-02849319a472", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-12-31T08:19:43+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-12-31T08:19:43+00:00"}, "scope": {"notes": "Affected: SibSoft / Xfilesharing | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18952", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18952"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 1, "vendor": "SibSoft", "30d_avg": 4, "90d_avg": 4, "product": "Xfilesharing", "cisa_kev": "no", "connections": 15, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "be67f333-5cb2-4428-9908-b1b488dfe351", "vulnerability": {"vulnId": "CVE-2025-34021", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "be67f333-5cb2-4428-9908-b1b488dfe351", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-19T09:39:53+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-19T09:39:53+00:00"}, "scope": {"notes": "Affected: Selea / Targa IP OCR-ANPR Camera | Class: video-system | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34021", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34021"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Selea", "30d_avg": 0, "90d_avg": 0, "product": "Targa IP OCR-ANPR Camera", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f0a60d64-e730-47c2-8676-e10270640c4d", "vulnerability": {"vulnId": "CVE-2021-41266", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f0a60d64-e730-47c2-8676-e10270640c4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:35:27+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:35:27+00:00"}, "scope": {"notes": "Affected: MiniIO / MiniIO Console | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-41266", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41266"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "MiniIO", "30d_avg": 1, "90d_avg": 2, "product": "MiniIO Console", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8b98ad31-1620-4b36-a208-ab6d89725578", "vulnerability": {"vulnId": "CVE-2020-17505", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8b98ad31-1620-4b36-a208-ab6d89725578", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Artica / Artica Web Proxy | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17505", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17505"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Artica", "30d_avg": 5, "90d_avg": 4, "product": "Artica Web Proxy", "cisa_kev": "no", "connections": 11, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "44cbfa7c-bae3-4f51-b43b-e9f9da37e7bc", "vulnerability": {"vulnId": "CVE-2022-0784", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "44cbfa7c-bae3-4f51-b43b-e9f9da37e7bc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:20:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:20:42+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Title Experiments Free plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0784", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0784"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 2, "product": "Wordpress Title Experiments Free plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bd4d2e10-260c-4021-b17d-1f7a7ff05f1a", "vulnerability": {"vulnId": "CVE-2018-9205", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bd4d2e10-260c-4021-b17d-1f7a7ff05f1a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:00+00:00"}, "scope": {"notes": "Affected: Drupal / Drupal avatar_uploader | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-9205", "url": "https://www.cve.org/CVERecord?id=CVE-2018-9205"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Drupal", "30d_avg": 0, "90d_avg": 2, "product": "Drupal avatar_uploader", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "7f629624-1d7a-4924-879d-d911695e22b7", "vulnerability": {"vulnId": "CVE-2021-43711", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7f629624-1d7a-4924-879d-d911695e22b7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Totolink / EX200 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-43711", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43711"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 4, "vendor": "Totolink", "30d_avg": 6, "90d_avg": 4, "product": "EX200", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5c5574ca-4faf-4fbe-b619-77414b154f9e", "vulnerability": {"vulnId": "CVE-2018-14839", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5c5574ca-4faf-4fbe-b619-77414b154f9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:34:12+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:34:12+00:00"}, "scope": {"notes": "Affected: LG / NAS N1A1 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-16: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-14839", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14839"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 1, "vendor": "LG", "30d_avg": 5, "90d_avg": 4, "product": "NAS N1A1", "cisa_kev": "yes", "connections": 20, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e3250640-71a1-4d07-a214-e8e5a6c99827", "vulnerability": {"vulnId": "CVE-2023-41109", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e3250640-71a1-4d07-a214-e8e5a6c99827", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-22T00:48:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-06-22T00:48:28+00:00"}, "scope": {"notes": "Affected: Patton / SmartNode SN200 | Class: voip | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-41109", "url": "https://www.cve.org/CVERecord?id=CVE-2023-41109"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Patton", "30d_avg": 1, "90d_avg": 2, "product": "SmartNode SN200", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6889a30d-c929-4ab6-a8d5-6557dad98cf8", "vulnerability": {"vulnId": "EDB-42392", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6889a30d-c929-4ab6-a8d5-6557dad98cf8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:55:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:40+00:00"}, "scope": {"notes": "Affected: GitHub / GitHub Enterprise < 2.8.7 | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-42392", "url": "https://www.exploit-db.com/exploits/42392"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GitHub", "30d_avg": 0, "90d_avg": 1, "product": "GitHub Enterprise < 2.8.7", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "edba2d8d-e680-463b-9ebc-952d04d81600", "vulnerability": {"vulnId": "CVE-2021-42237", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "edba2d8d-e680-463b-9ebc-952d04d81600", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:42:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:42:58+00:00"}, "scope": {"notes": "Affected: Sitecore / Sitecore XP | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-42237", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42237"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Sitecore", "30d_avg": 1, "90d_avg": 2, "product": "Sitecore XP", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "848c2157-78d4-4251-aaf2-b76b0b888ce3", "vulnerability": {"vulnId": "CVE-2024-36857", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "848c2157-78d4-4251-aaf2-b76b0b888ce3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-08-15T08:02:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-15T08:02:37+00:00"}, "scope": {"notes": "Affected: Homebrew Computer Company / Jan | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-36857", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36857"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Homebrew Computer Company", "30d_avg": 0, "90d_avg": 0, "product": "Jan", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8a4de1e6-b450-4218-b403-fec14f05e0bf", "vulnerability": {"vulnId": "CVE-2018-15517", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8a4de1e6-b450-4218-b403-fec14f05e0bf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2023-10-14T20:53:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T20:53:30+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link Central WiFiManager CWM-100 | Class: device-management-platform | Severity: High (CVSS 8.6) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-15517", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15517"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 1, "product": "D-Link Central WiFiManager CWM-100", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "687997cc-1a3e-45e4-8d34-0d840f9a65e4", "vulnerability": {"vulnId": "CVE-2023-3606", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "687997cc-1a3e-45e4-8d34-0d840f9a65e4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-21T16:59:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-21T16:59:51+00:00"}, "scope": {"notes": "Affected: TamronOS / TamronOS IPTV/VOD | Class: other-software | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3606", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3606"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "TamronOS", "30d_avg": 0, "90d_avg": 0, "product": "TamronOS IPTV/VOD", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f08c7439-2721-46e8-841e-ff4cd2160595", "vulnerability": {"vulnId": "CVE-2020-23575", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f08c7439-2721-46e8-841e-ff4cd2160595", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T04:58:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T04:58:42+00:00"}, "scope": {"notes": "Affected: Kyocera / Kyocera Printer d-COPIA253MF plus | Class: other-software | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-23575", "url": "https://www.cve.org/CVERecord?id=CVE-2020-23575"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Kyocera", "30d_avg": 0, "90d_avg": 1, "product": "Kyocera Printer d-COPIA253MF plus", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "ea3022d3-b18b-4250-8d49-a4d781c7d3b9", "vulnerability": {"vulnId": "CVE-2022-2488", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ea3022d3-b18b-4250-8d49-a4d781c7d3b9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WN535K2 and WN535K3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2488", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2488"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "WAVLINK", "30d_avg": 1, "90d_avg": 2, "product": "WAVLINK WN535K2 and WN535K3", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "83d7e032-e1fb-4ead-9aae-cb4cd38fadd0", "vulnerability": {"vulnId": "CVE-2024-55457", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "83d7e032-e1fb-4ead-9aae-cb4cd38fadd0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-27T11:03:21+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-27T11:03:21+00:00"}, "scope": {"notes": "Affected: MasterSAM / MasterSAM Star Gate | Class: device-management-platform | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-55457", "url": "https://www.cve.org/CVERecord?id=CVE-2024-55457"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "MasterSAM", "30d_avg": 0, "90d_avg": 1, "product": "MasterSAM Star Gate", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "1a49890e-0379-4539-a1aa-6d888520362d", "vulnerability": {"vulnId": "CVE-2024-9707", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1a49890e-0379-4539-a1aa-6d888520362d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-12T14:27:42+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-12T14:27:42+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Hunk Companion plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9707", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9707"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Hunk Companion plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "321d3641-e937-4d96-8074-d51df7d0d818", "vulnerability": {"vulnId": "CVE-2023-23333", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "321d3641-e937-4d96-8074-d51df7d0d818", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:44+00:00"}, "scope": {"notes": "Affected: CONTEC / SolarView Compact | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-23333", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23333"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "CONTEC", "30d_avg": 1, "90d_avg": 2, "product": "SolarView Compact", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0e02fd27-6c56-477b-b576-2aed10813fbd", "vulnerability": {"vulnId": "CVE-2023-30625", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e02fd27-6c56-477b-b576-2aed10813fbd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-23T18:54:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-23T18:54:46+00:00"}, "scope": {"notes": "Affected: RudderStack / Rudder Server | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-30625", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30625"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "RudderStack", "30d_avg": 1, "90d_avg": 2, "product": "Rudder Server", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "386034fb-5153-4139-956a-6129bb0220ef", "vulnerability": {"vulnId": "CVE-2022-0867", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "386034fb-5153-4139-956a-6129bb0220ef", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:35:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:35:20+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress ARPrice Lite plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0867", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0867"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 3, "product": "Wordpress ARPrice Lite plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1fb9f1db-ba89-4406-af8d-cf594c936a06", "vulnerability": {"vulnId": "CVE-2018-17246", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fb9f1db-ba89-4406-af8d-cf594c936a06", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:43:15+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:43:15+00:00"}, "scope": {"notes": "Affected: Elastic / Kibana | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-17246", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17246"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Elastic", "30d_avg": 0, "90d_avg": 1, "product": "Kibana", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "9875c023-e319-4d43-95da-d245e35da1f4", "vulnerability": {"vulnId": "CVE-2017-9833", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9875c023-e319-4d43-95da-d245e35da1f4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:55:46+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:55:46+00:00"}, "scope": {"notes": "Affected: Boa / Boa | Class: embedded-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-9833", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9833"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Boa", "30d_avg": 0, "90d_avg": 2, "product": "Boa", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8d1a080e-1836-4910-8042-5c7530e41a29", "vulnerability": {"vulnId": "CVE-2024-38475", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8d1a080e-1836-4910-8042-5c7530e41a29", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2025-07-17T18:30:06+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-07-17T18:30:06+00:00"}, "scope": {"notes": "Affected: Apache / Apache HTTP Server | Class: web-server | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-38475", "url": "https://www.cve.org/CVERecord?id=CVE-2024-38475"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 2, "product": "Apache HTTP Server", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "9ad1b587-1724-4787-b333-28f81b595efd", "vulnerability": {"vulnId": "CVE-2022-50993", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9ad1b587-1724-4787-b333-28f81b595efd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:44+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-50993", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50993"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-Office", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5d357415-9260-45b4-b0e9-0349abc1c7de", "vulnerability": {"vulnId": "CVE-2018-11714", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5d357415-9260-45b4-b0e9-0349abc1c7de", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-25T10:56:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-01-25T10:56:01+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link TL-WR840N v5, TL-WR841N v13 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11714", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11714"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "TP-Link", "30d_avg": 0, "90d_avg": 2, "product": "TP-Link TL-WR840N v5, TL-WR841N v13", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "49777175-f875-4b65-9484-dda76fbb0215", "vulnerability": {"vulnId": "CVE-2019-16662", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "49777175-f875-4b65-9484-dda76fbb0215", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:05+00:00"}, "scope": {"notes": "Affected: rConfig / rConfig | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-16662", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16662"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "rConfig", "30d_avg": 0, "90d_avg": 2, "product": "rConfig", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6614fae9-3900-4044-9f44-b4b2eff31610", "vulnerability": {"vulnId": "CVE-2020-13158", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6614fae9-3900-4044-9f44-b4b2eff31610", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:20+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:20+00:00"}, "scope": {"notes": "Affected: Artica / Artica Proxy | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13158", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13158"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Artica", "30d_avg": 0, "90d_avg": 1, "product": "Artica Proxy", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "adb7f1ae-7565-44ba-a323-ba33cd9d31fc", "vulnerability": {"vulnId": "CVE-2024-45309", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "adb7f1ae-7565-44ba-a323-ba33cd9d31fc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:14:18+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-05-16T15:14:18+00:00"}, "scope": {"notes": "Affected: OneDev / OneDev | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-45309", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45309"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "OneDev", "30d_avg": 4, "90d_avg": 3, "product": "OneDev", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5d3b28a7-642e-4a31-965e-ce488c242b34", "vulnerability": {"vulnId": "CVE-2023-28770", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5d3b28a7-642e-4a31-965e-ce488c242b34", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-19T12:30:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-19T12:30:00+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel DX5401-B0 | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-28770", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28770"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Zyxel DX5401-B0", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e2bb6d20-825b-4367-9db3-c6c3ec81e14b", "vulnerability": {"vulnId": "CVE-2022-1386", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e2bb6d20-825b-4367-9db3-c6c3ec81e14b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-15T22:57:37+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-15T22:57:37+00:00"}, "scope": {"notes": "Affected: Wordpress / WordPress Fusion Builder plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1386", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1386"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 4, "90d_avg": 4, "product": "WordPress Fusion Builder plugin", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eae56478-11e4-4a4c-b73f-444729e60b1d", "vulnerability": {"vulnId": "CVE-2022-28219", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eae56478-11e4-4a4c-b73f-444729e60b1d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:28+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:28+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine ADAudit Plus | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28219", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28219"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 2, "product": "ManageEngine ADAudit Plus", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ef488d50-f380-400e-a8fb-9b608b35a8d3", "vulnerability": {"vulnId": "CVE-2025-22214", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ef488d50-f380-400e-a8fb-9b608b35a8d3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2025-11-28T10:56:25+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-28T10:56:25+00:00"}, "scope": {"notes": "Affected: Landray / Landray EIS | Class: other-software | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-22214", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22214"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Landray", "30d_avg": 0, "90d_avg": 1, "product": "Landray EIS", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "0f6f8deb-226c-44d7-b4da-0df246b247bf", "vulnerability": {"vulnId": "CVE-2021-26295", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f6f8deb-226c-44d7-b4da-0df246b247bf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:54+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:54+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 37", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-26295", "url": "https://www.cve.org/CVERecord?id=CVE-2021-26295"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Apache", "30d_avg": 1, "90d_avg": 5, "product": "OFBiz", "cisa_kev": "no", "connections": 37, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "acfafb56-57b8-4d79-996c-ed31bb0f746b", "vulnerability": {"vulnId": "CVE-2024-31750", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "acfafb56-57b8-4d79-996c-ed31bb0f746b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-07-03T10:48:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-07-03T10:48:56+00:00"}, "scope": {"notes": "Affected: F-Logic / DataCube3 | Class: other-software | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-31750", "url": "https://www.cve.org/CVERecord?id=CVE-2024-31750"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "F-Logic", "30d_avg": 1, "90d_avg": 2, "product": "DataCube3", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a7dc7b4b-a2d5-4db8-bac9-a8d05d83d4f6", "vulnerability": {"vulnId": "CVE-2023-2806", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a7dc7b4b-a2d5-4db8-bac9-a8d05d83d4f6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-04-09T15:11:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2026-04-09T15:11:01+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver e-cology | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-2806", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2806"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver e-cology", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "9f1b8b43-70ed-48b6-abec-63f57ecdccc4", "vulnerability": {"vulnId": "CVE-2022-2414", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9f1b8b43-70ed-48b6-abec-63f57ecdccc4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:26+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:26+00:00"}, "scope": {"notes": "Affected: Dogtag / Dogtag - Certificate System | Class: security-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2414", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2414"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Dogtag", "30d_avg": 0, "90d_avg": 2, "product": "Dogtag - Certificate System", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c9a3280f-259a-42c3-810a-1de570f96969", "vulnerability": {"vulnId": "CVE-2023-5148", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c9a3280f-259a-42c3-810a-1de570f96969", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-08-06T02:40:08+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-08-06T02:40:08+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DAR-7000 and DAR-8000 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5148", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5148"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 2, "product": "D-Link DAR-7000 and DAR-8000", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "b54971d5-7a3f-434a-8170-ff075ff39f6c", "vulnerability": {"vulnId": "CVE-2022-30525", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b54971d5-7a3f-434a-8170-ff075ff39f6c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:30+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:30+00:00"}, "scope": {"notes": "Affected: Zyxel / USG FLEX 100, 100W, 200, 500, 700, USG20-VPN, USG20W-VPN, ATP 100, 200, 500, 700, 800 | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-30525", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30525"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "Zyxel", "30d_avg": 1, "90d_avg": 2, "product": "USG FLEX 100, 100W, 200, 500, 700, USG20-VPN, USG20W-VPN, ATP 100, 200, 500, 700, 800", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "abc8fb28-bd7a-44cd-8e7b-0f16b006b753", "vulnerability": {"vulnId": "CVE-2017-12635", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "abc8fb28-bd7a-44cd-8e7b-0f16b006b753", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:18:34+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:18:34+00:00"}, "scope": {"notes": "Affected: Apache / CouchDB | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 32", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-12635", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12635"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 1, "vendor": "Apache", "30d_avg": 2, "90d_avg": 2, "product": "CouchDB", "cisa_kev": "no", "connections": 32, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "79624b1c-7aa9-41a7-958b-324715da78ed", "vulnerability": {"vulnId": "CVE-2023-3710", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "79624b1c-7aa9-41a7-958b-324715da78ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-06T20:33:11+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-06T20:33:11+00:00"}, "scope": {"notes": "Affected: Honeywell / Honeywell PM43 | Class: printer | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3710", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3710"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 1, "vendor": "Honeywell", "30d_avg": 1, "90d_avg": 2, "product": "Honeywell PM43", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ace32528-95a5-48c9-9f22-40f8ef7bc65f", "vulnerability": {"vulnId": "CVE-2021-24212", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ace32528-95a5-48c9-9f22-40f8ef7bc65f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-18T08:18:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-18T08:18:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WooCommerce Help Scout WordPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-24212", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24212"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress WooCommerce Help Scout WordPress plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0da89af8-c43a-4f9f-b6d6-bccb30f67ed5", "vulnerability": {"vulnId": "CVE-2021-33564", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0da89af8-c43a-4f9f-b6d6-bccb30f67ed5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T17:23:14+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T17:23:14+00:00"}, "scope": {"notes": "Affected: Ruby Dragonfly / Ruby Dragonfly | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-33564", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33564"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Ruby Dragonfly", "30d_avg": 4, "90d_avg": 3, "product": "Ruby Dragonfly", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d1ed91f0-0cb3-46de-b425-9fa49bbcd60a", "vulnerability": {"vulnId": "CVE-2018-6961", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d1ed91f0-0cb3-46de-b425-9fa49bbcd60a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-12-12T21:38:58+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-12-12T21:38:58+00:00"}, "scope": {"notes": "Affected: VMware / VMware NSX SD-WAN Edge | Class: app-delivery-controller | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-6961", "url": "https://www.cve.org/CVERecord?id=CVE-2018-6961"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 1, "vendor": "VMware", "30d_avg": 5, "90d_avg": 4, "product": "VMware NSX SD-WAN Edge", "cisa_kev": "yes", "connections": 18, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "cc3f7f8d-615c-4463-ac98-4c6bfb10d05c", "vulnerability": {"vulnId": "CVE-2021-31602", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc3f7f8d-615c-4463-ac98-4c6bfb10d05c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:56:57+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:57+00:00"}, "scope": {"notes": "Affected: Hitachi Ventara / Pentaho Business Analytics | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-31602", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31602"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hitachi Ventara", "30d_avg": 5, "90d_avg": 4, "product": "Pentaho Business Analytics", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c5d47bfd-92e0-4701-a38e-9106ccc9511f", "vulnerability": {"vulnId": "CVE-2023-26067", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c5d47bfd-92e0-4701-a38e-9106ccc9511f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-10-14T14:57:45+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:45+00:00"}, "scope": {"notes": "Affected: Lexmark / Lexmark | Class: printer | Severity: High (CVSS 8.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26067", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26067"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 0, "vendor": "Lexmark", "30d_avg": 0, "90d_avg": 2, "product": "Lexmark", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "8e6fdba2-bf1b-4cf0-80ec-cf17c60301e9", "vulnerability": {"vulnId": "CVE-2018-10823", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8e6fdba2-bf1b-4cf0-80ec-cf17c60301e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-02-06T12:28:44+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-02-06T12:28:44+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DWR series | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-10823", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10823"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 2, "product": "D-Link DWR series", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "6016f101-ed09-4056-8a4c-a7d4328684f3", "vulnerability": {"vulnId": "CVE-2022-1390", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6016f101-ed09-4056-8a4c-a7d4328684f3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:25:10+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T18:25:10+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Admin Word Count Column plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1390", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1390"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 2, "product": "Wordpress Admin Word Count Column plugin", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "vulnerability": {"vulnId": "CVE-2021-25003", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:29+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:29+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress WPCargo Track & Trace plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-25003", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25003"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 6, "90d_avg": 4, "product": "Wordpress WPCargo Track & Trace plugin", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a99d15ad-b04a-406e-b7d5-7fff80385c52", "vulnerability": {"vulnId": "CVE-2024-20440", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a99d15ad-b04a-406e-b7d5-7fff80385c52", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-11-17T08:34:36+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-17T08:34:36+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Smart Licensing Utility | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-20440", "url": "https://www.cve.org/CVERecord?id=CVE-2024-20440"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 1, "product": "Cisco Smart Licensing Utility", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "87bb45e8-4201-4e96-b219-b7423cf0bea9", "vulnerability": {"vulnId": "CVE-2021-29203", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "87bb45e8-4201-4e96-b219-b7423cf0bea9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:56+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:56+00:00"}, "scope": {"notes": "Affected: HPE / HPE Edgeline Infrastructure Manager | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-29203", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29203"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HPE", "30d_avg": 4, "90d_avg": 4, "product": "HPE Edgeline Infrastructure Manager", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6b62ca2a-e7bf-4e44-9f14-2b3e3c589cbe", "vulnerability": {"vulnId": "CVE-2024-50603", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b62ca2a-e7bf-4e44-9f14-2b3e3c589cbe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-03T22:15:05+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-02-03T22:15:05+00:00"}, "scope": {"notes": "Affected: Aviatrix / Aviatrix Network Controller | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-50603", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50603"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Aviatrix", "30d_avg": 1, "90d_avg": 2, "product": "Aviatrix Network Controller", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "023c9def-ab1c-4d77-9a18-37e7af77030a", "vulnerability": {"vulnId": "CVE-2021-33357", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "023c9def-ab1c-4d77-9a18-37e7af77030a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:59+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:59+00:00"}, "scope": {"notes": "Affected: RaspAP / RaspAP | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-33357", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33357"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "RaspAP", "30d_avg": 0, "90d_avg": 1, "product": "RaspAP", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "26e6fd4c-0053-4d2f-a5fe-5ab680a28d7c", "vulnerability": {"vulnId": "CVE-2022-2314", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "26e6fd4c-0053-4d2f-a5fe-5ab680a28d7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:40+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:40+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress VR Calendar plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2314", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 4, "product": "Wordpress VR Calendar plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "20d39fab-517b-4dc7-9c3e-5e9046d46e2f", "vulnerability": {"vulnId": "CVE-2024-43360", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "20d39fab-517b-4dc7-9c3e-5e9046d46e2f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-08T20:30:51+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-06-08T20:30:51+00:00"}, "scope": {"notes": "Affected: ZoneMinder / ZoneMinder | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-43360", "url": "https://www.cve.org/CVERecord?id=CVE-2024-43360"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "ZoneMinder", "30d_avg": 0, "90d_avg": 2, "product": "ZoneMinder", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2d7aa1d4-fd99-4d11-ac96-06ce14cc4642", "vulnerability": {"vulnId": "CVE-2024-27497", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2d7aa1d4-fd99-4d11-ac96-06ce14cc4642", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-03-19T15:53:17+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2024-03-19T15:53:17+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys E2000 | Class: router | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27497", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27497"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Linksys", "30d_avg": 0, "90d_avg": 1, "product": "Linksys E2000", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a464144c-d7bb-40ed-9782-ded524ae75c2", "vulnerability": {"vulnId": "CVE-2023-45852", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a464144c-d7bb-40ed-9782-ded524ae75c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-01T13:57:35+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-11-01T13:57:35+00:00"}, "scope": {"notes": "Affected: Viessmann / Vitogate 300 BN/MB | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-45852", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45852"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Viessmann", "30d_avg": 1, "90d_avg": 2, "product": "Vitogate 300 BN/MB", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "15892ee1-1256-43af-9ccf-5fbf314bc003", "vulnerability": {"vulnId": "CVE-2020-17456", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "15892ee1-1256-43af-9ccf-5fbf314bc003", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Seowon Intech / Seowon SLC-130, SLR-120S | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-16: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17456", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17456"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Seowon Intech", "30d_avg": 5, "90d_avg": 4, "product": "Seowon SLC-130, SLR-120S", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "83bdc09d-09d3-436f-a50f-53acb5924cdd", "vulnerability": {"vulnId": "CVE-2024-32739", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "83bdc09d-09d3-436f-a50f-53acb5924cdd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-01-22T16:43:00+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-01-22T16:43:00+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32739", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32739"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CyberPanel", "30d_avg": 0, "90d_avg": 1, "product": "CyberPanel", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8647471c-4f04-4a83-8bd7-e99eab390cab", "vulnerability": {"vulnId": "CVE-2021-22053", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8647471c-4f04-4a83-8bd7-e99eab390cab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-14T14:56:49+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:49+00:00"}, "scope": {"notes": "Affected: Spring / Spring Cloud Netflix | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22053", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22053"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Spring", "30d_avg": 5, "90d_avg": 4, "product": "Spring Cloud Netflix", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "c460fc76-7e11-4542-999b-368ae27de3ff", "vulnerability": {"vulnId": "CVE-2023-7304", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c460fc76-7e11-4542-999b-368ae27de3ff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-11-14T16:59:50+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-11-14T16:59:50+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / Ruijie RG-UAC Application Management Gateway | Class: security-management-platform | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7304", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7304"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "Ruijie RG-UAC Application Management Gateway", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "d8f79889-8c4a-4f35-9e1a-96059a7f56bc", "vulnerability": {"vulnId": "CVE-2024-11238", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d8f79889-8c4a-4f35-9e1a-96059a7f56bc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-05-09T04:41:01+00:00", "recorded_at": "2026-07-18T01:00:01+00:00", "last_seen_at": "2026-07-16T00:00:00+00:00", "first_seen_at": "2025-05-09T04:41:01+00:00"}, "scope": {"notes": "Affected: Landray / Landray EKP | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-16: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-11238", "url": "https://www.cve.org/CVERecord?id=CVE-2024-11238"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Landray", "30d_avg": 0, "90d_avg": 0, "product": "Landray EKP", "cisa_kev": "no", "connections": 7, "observation_date": "2026-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "5d940dd7-2e15-4f5f-bc34-ba15b49b01cd", "vulnerability": {"vulnId": "CVE-2019-8446", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5d940dd7-2e15-4f5f-bc34-ba15b49b01cd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T13:57:48+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T13:57:48+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-8446", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8446"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 0, "product": "JIRA", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "1d2c0170-b9db-40d0-b2ee-6295b81db7bc", "vulnerability": {"vulnId": "CVE-2019-17503", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1d2c0170-b9db-40d0-b2ee-6295b81db7bc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T09:36:38+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T09:36:38+00:00"}, "scope": {"notes": "Affected: Kirona / Kirona Dynamic Resource Scheduling (DRS) | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-17503", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17503"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Kirona", "30d_avg": 0, "90d_avg": 0, "product": "Kirona Dynamic Resource Scheduling (DRS)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "92f79167-c74c-46d2-ab9e-4e64ad40d617", "vulnerability": {"vulnId": "CVE-2022-1916", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "92f79167-c74c-46d2-ab9e-4e64ad40d617", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:26:06+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:26:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Active Products Tables for WooCommerce | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1916"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Active Products Tables for WooCommerce", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "90ce6df6-5fa3-4da2-93b8-7bb7336831a0", "vulnerability": {"vulnId": "CVE-2019-8451", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "90ce6df6-5fa3-4da2-93b8-7bb7336831a0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-23T14:03:23+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T14:03:23+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-8451", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8451"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 0, "product": "JIRA", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "1fe4e012-2534-49ce-893f-5b94412a377e", "vulnerability": {"vulnId": "CVE-2021-22122", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1fe4e012-2534-49ce-893f-5b94412a377e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T17:56:07+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T17:56:07+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiWeb | Class: firewall | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22122", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22122"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Fortinet", "30d_avg": 0, "90d_avg": 0, "product": "FortiWeb", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "359d5740-171e-45a1-ad87-283811cfe5b9", "vulnerability": {"vulnId": "CVE-2017-7921", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "359d5740-171e-45a1-ad87-283811cfe5b9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-16T12:46:02+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-16T12:46:02+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision DS series multiple products | Class: video-system | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-15: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-7921", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7921"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Hikvision", "30d_avg": 1, "90d_avg": 1, "product": "Hikvision DS series multiple products", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "33dea968-5663-4f72-a620-5f8b5a0296fa", "vulnerability": {"vulnId": "CVE-2022-1439", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "33dea968-5663-4f72-a620-5f8b5a0296fa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:24:58+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:24:58+00:00"}, "scope": {"notes": "Affected: Microweber / Microweber | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1439", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1439"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Microweber", "30d_avg": 0, "90d_avg": 0, "product": "Microweber", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "f0d03751-785d-4cf9-beeb-d82743269c50", "vulnerability": {"vulnId": "CVE-2022-0142", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f0d03751-785d-4cf9-beeb-d82743269c50", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-12-01T11:35:49+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-12-01T11:35:49+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Visual Form Builder plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0142", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0142"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Visual Form Builder plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "63d4b861-0e20-4b92-a66c-784ccf3e59f4", "vulnerability": {"vulnId": "CVE-2025-30220", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "63d4b861-0e20-4b92-a66c-784ccf3e59f4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-22T08:01:05+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-07-22T08:01:05+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 10590", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-30220", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30220"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "18", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 7, "vendor": "Geoserver", "30d_avg": 3, "90d_avg": 1, "product": "Geoserver", "cisa_kev": "no", "connections": 10590, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ef9ad506-6ed0-48e7-84ed-a785bdadbf39", "vulnerability": {"vulnId": "CVE-2021-30168", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ef9ad506-6ed0-48e7-84ed-a785bdadbf39", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T23:16:02+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-13T23:16:02+00:00"}, "scope": {"notes": "Affected: LILIN / LILIN DVR | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-30168", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30168"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "LILIN", "30d_avg": 0, "90d_avg": 0, "product": "LILIN DVR", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1b77f76f-a1e1-4ad3-938e-b2d26421d3e6", "vulnerability": {"vulnId": "CVE-2020-28185", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b77f76f-a1e1-4ad3-938e-b2d26421d3e6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T17:47:14+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T17:47:14+00:00"}, "scope": {"notes": "Affected: Terramaster / TOS | Class: nas | Severity: Medium (CVSS 5.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-28185", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28185"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Terramaster", "30d_avg": 0, "90d_avg": 0, "product": "TOS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "8c83de7e-399d-4291-8367-a61454ee1fbd", "vulnerability": {"vulnId": "CVE-2021-45422", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8c83de7e-399d-4291-8367-a61454ee1fbd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2025-06-05T01:49:18+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-06-05T01:49:18+00:00"}, "scope": {"notes": "Affected: Reprise / Reprise License Manager | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-45422", "url": "https://www.cve.org/CVERecord?id=CVE-2021-45422"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Reprise", "30d_avg": 0, "90d_avg": 0, "product": "Reprise License Manager", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "a1c5bef3-7734-4db7-a4cd-eb0c1a7a9cf4", "vulnerability": {"vulnId": "CVE-2022-22242", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a1c5bef3-7734-4db7-a4cd-eb0c1a7a9cf4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:26:55+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:26:55+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS (J-Web) | Class: router | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22242", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22242"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Juniper", "30d_avg": 0, "90d_avg": 14, "product": "Junos OS (J-Web)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "0665e218-c8be-4be5-900a-5ae56e9d7227", "vulnerability": {"vulnId": "CVE-2025-47204", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0665e218-c8be-4be5-900a-5ae56e9d7227", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2025-07-21T20:43:25+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-07-21T20:43:25+00:00"}, "scope": {"notes": "Affected: David Strutz / bootstrap-multiselect | Class: other-software | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-47204", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47204"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "David Strutz", "30d_avg": 0, "90d_avg": 0, "product": "bootstrap-multiselect", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "80a98baa-eb66-4d50-aff8-fb4d49b8aaec", "vulnerability": {"vulnId": "CVE-2015-2863", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "80a98baa-eb66-4d50-aff8-fb4d49b8aaec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-12-11T19:51:31+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-12-11T19:51:31+00:00"}, "scope": {"notes": "Affected: Kaseya / VSA | Class: device-management-platform | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-2863", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2863"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Kaseya", "30d_avg": 0, "90d_avg": 0, "product": "VSA", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a12d2886-07cc-4ebe-af1b-f5c4d527f72a", "vulnerability": {"vulnId": "CVE-2021-46379", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a12d2886-07cc-4ebe-af1b-f5c4d527f72a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:19:18+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:19:18+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR850 | Class: router | Severity: Medium (CVSS 6.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-46379", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46379"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR850", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "34f8c224-364c-471e-8bc8-153075846571", "vulnerability": {"vulnId": "CVE-2023-36844", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "34f8c224-364c-471e-8bc8-153075846571", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-14T16:00:38+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-14T16:00:38+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS (J-Web) | Class: router | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-36844", "url": "https://www.cve.org/CVERecord?id=CVE-2023-36844"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Juniper", "30d_avg": 1, "90d_avg": 10, "product": "Junos OS (J-Web)", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e7940a09-54d4-449f-b678-9caeed08ec0e", "vulnerability": {"vulnId": "CVE-2020-10770", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e7940a09-54d4-449f-b678-9caeed08ec0e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T16:04:20+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T16:04:20+00:00"}, "scope": {"notes": "Affected: Keycloak / Keycloak | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10770", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10770"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Keycloak", "30d_avg": 0, "90d_avg": 0, "product": "Keycloak", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "ffec618a-8437-48ce-b579-90118f457225", "vulnerability": {"vulnId": "CVE-2022-28363", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ffec618a-8437-48ce-b579-90118f457225", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2025-06-05T02:56:14+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-06-05T02:56:14+00:00"}, "scope": {"notes": "Affected: Reprise / Reprise License Manager | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28363"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Reprise", "30d_avg": 0, "90d_avg": 0, "product": "Reprise License Manager", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "151cf4f8-0671-4796-a26a-c7c7b22473d1", "vulnerability": {"vulnId": "CVE-2020-9314", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "151cf4f8-0671-4796-a26a-c7c7b22473d1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 48}, "timestamps": {"asserted_at": "2026-05-16T21:20:08+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2026-05-16T21:20:08+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle iPlanet Web Server | Class: web-server | Severity: Medium (CVSS 4.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-9314", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle iPlanet Web Server", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 4.8, "vulnerability_severity": "Medium"}}]}
{"uuid": "6982fb86-a126-486a-a607-b1430e9c0c2b", "vulnerability": {"vulnId": "CVE-2023-4220", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6982fb86-a126-486a-a607-b1430e9c0c2b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-12-05T06:27:23+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:23+00:00"}, "scope": {"notes": "Affected: Chamilo / Chamilo | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4220", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4220"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Chamilo", "30d_avg": 1, "90d_avg": 0, "product": "Chamilo", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "d7bb84a0-13cf-450a-b125-a07a03bb2f24", "vulnerability": {"vulnId": "CVE-2023-28771", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d7bb84a0-13cf-450a-b125-a07a03bb2f24", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:00:48+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-13T16:00:48+00:00"}, "scope": {"notes": "Affected: Zyxel | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-28771", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28771"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "ikev2-scan", "class": null, "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ad37b9fa-e724-497a-93cf-dc840e8c30b5", "vulnerability": {"vulnId": "CVE-2021-39211", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ad37b9fa-e724-497a-93cf-dc840e8c30b5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-18T18:13:54+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-18T18:13:54+00:00"}, "scope": {"notes": "Affected: GLPI / GLPI | Class: device-management-platform | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39211", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39211"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "GLPI", "30d_avg": 0, "90d_avg": 0, "product": "GLPI", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "fb1a8a7e-3527-4cf0-ae19-0dbb80583bdf", "vulnerability": {"vulnId": "CVE-2022-28365", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fb1a8a7e-3527-4cf0-ae19-0dbb80583bdf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-06-05T02:33:43+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-06-05T02:33:43+00:00"}, "scope": {"notes": "Affected: Reprise / Reprise License Manager | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28365", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28365"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Reprise", "30d_avg": 0, "90d_avg": 0, "product": "Reprise License Manager", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "bd2938ff-0a7f-4cea-8367-d355dd94dc14", "vulnerability": {"vulnId": "CVE-2023-2796", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bd2938ff-0a7f-4cea-8367-d355dd94dc14", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T23:23:34+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T23:23:34+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress EventON plugin | Class: cms | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-2796", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2796"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress EventON plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "56325e47-4f1d-48e1-9ac0-4c8b1addf48e", "vulnerability": {"vulnId": "CVE-2019-18935", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "56325e47-4f1d-48e1-9ac0-4c8b1addf48e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-23T21:52:33+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T21:52:33+00:00"}, "scope": {"notes": "Affected: Telerik / Telerik | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18935", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18935"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Telerik", "30d_avg": 0, "90d_avg": 0, "product": "Telerik", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c1177937-44ff-4e71-bea7-8cbc0bcd18b5", "vulnerability": {"vulnId": "CVE-2023-35081", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c1177937-44ff-4e71-bea7-8cbc0bcd18b5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-13T18:56:41+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-13T18:56:41+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-35081", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35081"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 6, "vendor": "Ivanti", "30d_avg": 5, "90d_avg": 7, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "35c9afd3-c8d0-4e5e-a45f-82801ce043a6", "vulnerability": {"vulnId": "CVE-2021-31250", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "35c9afd3-c8d0-4e5e-a45f-82801ce043a6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 54}, "timestamps": {"asserted_at": "2024-04-08T00:30:51+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-04-08T00:30:51+00:00"}, "scope": {"notes": "Affected: CHIYU Technology / CHIYU BF-430, BF-431 and BF-450M | Class: other-software | Severity: Medium (CVSS 5.4) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-31250", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31250"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "CHIYU Technology", "30d_avg": 0, "90d_avg": 0, "product": "CHIYU BF-430, BF-431 and BF-450M", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.4, "vulnerability_severity": "Medium"}}]}
{"uuid": "e6101ef0-7f75-4bde-9a7d-e6ef2db63184", "vulnerability": {"vulnId": "CVE-2018-11409", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e6101ef0-7f75-4bde-9a7d-e6ef2db63184", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-19T16:03:03+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-19T16:03:03+00:00"}, "scope": {"notes": "Affected: Splunk / Splunk | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-11409", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11409"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Splunk", "30d_avg": 0, "90d_avg": 0, "product": "Splunk", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "fae9c48f-ab33-4bea-adba-d6c32933bc99", "vulnerability": {"vulnId": "CVE-2024-6188", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fae9c48f-ab33-4bea-adba-d6c32933bc99", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2024-07-24T08:39:41+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-07-24T08:39:41+00:00"}, "scope": {"notes": "Affected: Parsec Automation / TrackSYS | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6188", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6188"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Parsec Automation", "30d_avg": 0, "90d_avg": 0, "product": "TrackSYS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "59de2fc8-5457-4041-b48f-db27edd5d234", "vulnerability": {"vulnId": "CVE-2021-21087", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "59de2fc8-5457-4041-b48f-db27edd5d234", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 54}, "timestamps": {"asserted_at": "2023-10-18T18:15:55+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-18T18:15:55+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: Medium (CVSS 5.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21087", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21087"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "ColdFusion", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.4, "vulnerability_severity": "Medium"}}]}
{"uuid": "9a8ff6ac-2bd6-4101-9d73-faaec11a9cec", "vulnerability": {"vulnId": "CVE-2021-42567", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9a8ff6ac-2bd6-4101-9d73-faaec11a9cec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:16:06+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:16:06+00:00"}, "scope": {"notes": "Affected: Apereo / CAS | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-42567", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42567"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apereo", "30d_avg": 0, "90d_avg": 0, "product": "CAS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "67d6ee14-bcb3-4577-9699-1a202a550479", "vulnerability": {"vulnId": "CVE-2024-7120", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "67d6ee14-bcb3-4577-9699-1a202a550479", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-21T19:13:28+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-09-21T19:13:28+00:00"}, "scope": {"notes": "Affected: RAISECOM / RAISECOM MSG1200, MSG2100E, MSG2200 and MSG2300 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7120", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7120"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "RAISECOM", "30d_avg": 1, "90d_avg": 0, "product": "RAISECOM MSG1200, MSG2100E, MSG2200 and MSG2300", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "dbafe10b-ffbc-4644-aede-717dd29ac2e3", "vulnerability": {"vulnId": "CVE-2021-21745", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dbafe10b-ffbc-4644-aede-717dd29ac2e3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2023-10-23T23:09:44+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T23:09:44+00:00"}, "scope": {"notes": "Affected: ZTE / ZTE MF971R | Class: router | Severity: Medium (CVSS 4.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21745", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21745"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ZTE", "30d_avg": 1, "90d_avg": 0, "product": "ZTE MF971R", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e3a88fa0-4d5c-4f11-b87c-99860674ca9a", "vulnerability": {"vulnId": "CVE-2022-35653", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e3a88fa0-4d5c-4f11-b87c-99860674ca9a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-02-15T14:49:48+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-02-15T14:49:48+00:00"}, "scope": {"notes": "Affected: Moodle / Moodle | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-35653", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35653"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Moodle", "30d_avg": 0, "90d_avg": 0, "product": "Moodle", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "301fcbef-def5-4a1a-a2fd-6cdb5c14d934", "vulnerability": {"vulnId": "CVE-2025-27222", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "301fcbef-def5-4a1a-a2fd-6cdb5c14d934", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2026-03-07T03:41:05+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2026-03-07T03:41:05+00:00"}, "scope": {"notes": "Affected: Rocket Software / Rocket TRUfusion Enterprise | Class: other-software | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-27222", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27222"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rocket Software", "30d_avg": 0, "90d_avg": 1, "product": "Rocket TRUfusion Enterprise", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "aa33a71d-f0f8-478e-ae79-547cdb1ddcbe", "vulnerability": {"vulnId": "CVE-2022-46381", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aa33a71d-f0f8-478e-ae79-547cdb1ddcbe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T13:10:08+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T13:10:08+00:00"}, "scope": {"notes": "Affected: Linear / eMerge E3-Series | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-46381", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46381"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Linear", "30d_avg": 0, "90d_avg": 0, "product": "eMerge E3-Series", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "10c38b20-742c-4f6b-8773-3d8d24b309e4", "vulnerability": {"vulnId": "CVE-2019-14223", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "10c38b20-742c-4f6b-8773-3d8d24b309e4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-12-11T19:57:20+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-12-11T19:57:20+00:00"}, "scope": {"notes": "Affected: Alfresco / Alfresco Community Edition (Alfresco Share) | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-14223", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14223"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Alfresco", "30d_avg": 1, "90d_avg": 0, "product": "Alfresco Community Edition (Alfresco Share)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "3b0d481d-72dd-4b2f-b58d-a27b03f57b35", "vulnerability": {"vulnId": "CVE-2020-8115", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3b0d481d-72dd-4b2f-b58d-a27b03f57b35", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T17:49:58+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T17:49:58+00:00"}, "scope": {"notes": "Affected: Revive / Revive Adserver | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8115", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8115"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Revive", "30d_avg": 0, "90d_avg": 0, "product": "Revive Adserver", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "b917be02-afde-4893-ac32-03f197dcf1a0", "vulnerability": {"vulnId": "CVE-2024-21899", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b917be02-afde-4893-ac32-03f197dcf1a0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-18T02:36:50+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-03-18T02:36:50+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS and QuTS Hero | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 1231", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21899", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21899"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "17", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 4, "vendor": "QNAP", "30d_avg": 1, "90d_avg": 0, "product": "QNAP QTS and QuTS Hero", "cisa_kev": "no", "connections": 1231, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d21529e9-7f1a-4d2e-a9bd-c3fa24267831", "vulnerability": {"vulnId": "CVE-2020-5775", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d21529e9-7f1a-4d2e-a9bd-c3fa24267831", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 58}, "timestamps": {"asserted_at": "2023-10-23T17:48:47+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T17:48:47+00:00"}, "scope": {"notes": "Affected: Canvas / Canvas LMS | Class: other-software | Severity: Medium (CVSS 5.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-5775", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5775"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Canvas", "30d_avg": 0, "90d_avg": 0, "product": "Canvas LMS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.8, "vulnerability_severity": "Medium"}}]}
{"uuid": "739d82ad-d6f9-4e24-947f-7f72b1493ee5", "vulnerability": {"vulnId": "CVE-2023-5914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "739d82ad-d6f9-4e24-947f-7f72b1493ee5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-05-08T05:28:10+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-05-08T05:28:10+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix StoreFront | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5914", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 0, "product": "Citrix StoreFront", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "b3529e69-23ae-4120-91ad-1af10116481b", "vulnerability": {"vulnId": "CVE-2023-38035", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b3529e69-23ae-4120-91ad-1af10116481b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:53+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:53+00:00"}, "scope": {"notes": "Affected: Ivanti / Sentry | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-38035", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38035"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 0, "product": "Sentry", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "44c3d4d0-9797-4107-8dc7-88af5db6c57a", "vulnerability": {"vulnId": "CVE-2017-12615", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "44c3d4d0-9797-4107-8dc7-88af5db6c57a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-10-14T06:18:54+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-14T06:18:54+00:00"}, "scope": {"notes": "Affected: Apache / Tomcat | Class: web-server | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-12615", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12615"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Tomcat", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "ff879a36-922e-4b29-86c3-0ee559c45c54", "vulnerability": {"vulnId": "CVE-2025-27505", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff879a36-922e-4b29-86c3-0ee559c45c54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-10-27T10:39:28+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-10-27T10:39:28+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 209", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-27505", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27505"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Geoserver", "30d_avg": 1, "90d_avg": 1, "product": "Geoserver", "cisa_kev": "no", "connections": 209, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "00473a1f-7d86-4da4-a96b-293ccf30c23d", "vulnerability": {"vulnId": "CVE-2024-0235", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "00473a1f-7d86-4da4-a96b-293ccf30c23d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-08-23T23:04:55+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-08-23T23:04:55+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress EventON plugin | Class: cms | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0235"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress EventON plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e6d5b02a-44c5-4b50-b961-956301dcd0db", "vulnerability": {"vulnId": "CVE-2020-24914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e6d5b02a-44c5-4b50-b961-956301dcd0db", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-23T17:45:44+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T17:45:44+00:00"}, "scope": {"notes": "Affected: QCubed / QCubed | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-24914", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "QCubed", "30d_avg": 1, "90d_avg": 0, "product": "QCubed", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "babf70ff-bbe6-4041-b5b0-ccf1795d56ed", "vulnerability": {"vulnId": "CVE-2022-2376", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "babf70ff-bbe6-4041-b5b0-ccf1795d56ed", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-23T18:28:11+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:28:11+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Directorist plugin | Class: cms | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-2376", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2376"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Directorist plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "0dc0c18b-98dd-4cc4-9077-44430660d8ce", "vulnerability": {"vulnId": "CVE-2020-11798", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0dc0c18b-98dd-4cc4-9077-44430660d8ce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-12-28T18:02:56+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-12-28T18:02:56+00:00"}, "scope": {"notes": "Affected: Mitel / MiCollab AWV | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11798", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11798"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Mitel", "30d_avg": 0, "90d_avg": 0, "product": "MiCollab AWV", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "0f532ac8-1af7-4be9-b289-971edbe2f023", "vulnerability": {"vulnId": "CVE-2020-25213", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f532ac8-1af7-4be9-b289-971edbe2f023", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T18:15:23+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-18T18:15:23+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-25213", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25213"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c6ae875c-8ab0-4991-a1ff-8238875e5dca", "vulnerability": {"vulnId": "CVE-2025-59474", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c6ae875c-8ab0-4991-a1ff-8238875e5dca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-10-27T10:43:33+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-10-27T10:43:33+00:00"}, "scope": {"notes": "Affected: Jenkins / Jenkins | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-59474", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59474"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Jenkins", "30d_avg": 0, "90d_avg": 0, "product": "Jenkins", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "91fc5166-7c91-4203-9c9a-f7683d44ebea", "vulnerability": {"vulnId": "CVE-2022-0346", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "91fc5166-7c91-4203-9c9a-f7683d44ebea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:21:39+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:21:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Google XML Sitemap Generator plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0346", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0346"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Google XML Sitemap Generator plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "8511776b-df72-4e0f-8df6-6a5483eda17f", "vulnerability": {"vulnId": "CVE-2025-53364", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8511776b-df72-4e0f-8df6-6a5483eda17f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-12-01T11:35:18+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-12-01T11:35:18+00:00"}, "scope": {"notes": "Affected: Parse Community / Parse Server | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-53364", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53364"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Parse Community", "30d_avg": 1, "90d_avg": 0, "product": "Parse Server", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "3a21839f-195d-4345-bb13-e9ad3f6421fc", "vulnerability": {"vulnId": "CVE-2021-4191", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3a21839f-195d-4345-bb13-e9ad3f6421fc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-17T22:27:31+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-17T22:27:31+00:00"}, "scope": {"notes": "Affected: GitLab / GitLab CE/EE | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-4191", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4191"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GitLab", "30d_avg": 1, "90d_avg": 0, "product": "GitLab CE/EE", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e9ff4d4b-f782-459f-b495-fac91dcb8a83", "vulnerability": {"vulnId": "CVE-2019-18393", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e9ff4d4b-f782-459f-b495-fac91dcb8a83", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2024-04-08T00:30:03+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-04-08T00:30:03+00:00"}, "scope": {"notes": "Affected: Ignite Realtime / Openfire | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-18393", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18393"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Ignite Realtime", "30d_avg": 0, "90d_avg": 0, "product": "Openfire", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "bbdae3b6-c491-4abc-91f0-f0524a13fe10", "vulnerability": {"vulnId": "CVE-2021-20092", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bbdae3b6-c491-4abc-91f0-f0524a13fe10", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-02-25T23:16:03+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-02-25T23:16:03+00:00"}, "scope": {"notes": "Affected: Buffalo / Buffalo SR-2533DHPL2 and WSR-2533DHP3 | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20092", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20092"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Buffalo", "30d_avg": 0, "90d_avg": 0, "product": "Buffalo SR-2533DHPL2 and WSR-2533DHP3", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "f9d40386-a969-4d67-90b2-b69264f0a969", "vulnerability": {"vulnId": "CVE-2024-20404", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f9d40386-a969-4d67-90b2-b69264f0a969", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-02-04T04:17:11+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2026-02-04T04:17:11+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Finesse | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-20404", "url": "https://www.cve.org/CVERecord?id=CVE-2024-20404"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco Finesse", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "50859dce-754c-43d7-bd68-16d9f4768a38", "vulnerability": {"vulnId": "CVE-2021-21402", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "50859dce-754c-43d7-bd68-16d9f4768a38", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-17T22:27:40+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-17T22:27:40+00:00"}, "scope": {"notes": "Affected: Jellyfin / Jellyfin | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-21402", "url": "https://www.cve.org/CVERecord?id=CVE-2021-21402"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Jellyfin", "30d_avg": 0, "90d_avg": 0, "product": "Jellyfin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "a80bc482-8ff3-4841-b892-1c221c43fd95", "vulnerability": {"vulnId": "CVE-2023-6634", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a80bc482-8ff3-4841-b892-1c221c43fd95", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-06T22:17:47+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-04-06T22:17:47+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6634", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6634"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "594830ba-10dd-45e7-a4e6-16aa8370f8ad", "vulnerability": {"vulnId": "CVE-2022-40843", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "594830ba-10dd-45e7-a4e6-16aa8370f8ad", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 49}, "timestamps": {"asserted_at": "2025-06-05T00:29:15+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2025-06-05T00:29:15+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda AC1200 V-W15Ev2 | Class: router | Severity: Medium (CVSS 4.9) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40843", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40843"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda AC1200 V-W15Ev2", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 4.9, "vulnerability_severity": "Medium"}}]}
{"uuid": "43210a69-c5f7-4dc5-a195-e28f44d26368", "vulnerability": {"vulnId": "CVE-2023-38192", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "43210a69-c5f7-4dc5-a195-e28f44d26368", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-12-05T06:27:22+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2024-12-05T06:27:22+00:00"}, "scope": {"notes": "Affected: Mirko B\u00c3\u00b6er Software Development / SuperWebMailer | Class: email | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-38192", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38192"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Mirko B\u00c3\u00b6er Software Development", "30d_avg": 0, "90d_avg": 0, "product": "SuperWebMailer", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "afae8563-e8ca-4a90-8f17-7223716422c8", "vulnerability": {"vulnId": "CVE-2023-1434", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "afae8563-e8ca-4a90-8f17-7223716422c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-23T18:48:28+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-23T18:48:28+00:00"}, "scope": {"notes": "Affected: Odoo / Odoo | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-1434", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1434"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Odoo", "30d_avg": 0, "90d_avg": 0, "product": "Odoo", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "06f63773-e1de-487c-a278-a466a8e0042d", "vulnerability": {"vulnId": "CVE-2022-46169", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "06f63773-e1de-487c-a278-a466a8e0042d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:57:51+00:00", "recorded_at": "2026-07-17T01:00:01+00:00", "last_seen_at": "2026-07-15T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:51+00:00"}, "scope": {"notes": "Affected: Cacti / Cacti | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-46169", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46169"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Cacti", "30d_avg": 0, "90d_avg": 0, "product": "Cacti", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b4e30f76-c6c8-43ff-a309-acb8f2eb3269", "vulnerability": {"vulnId": "CVE-2020-9377", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b4e30f76-c6c8-43ff-a309-acb8f2eb3269", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-16T03:05:09+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2023-10-16T03:05:09+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-610 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-14: 2714", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-9377", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9377"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "D-Link", "30d_avg": 1, "90d_avg": 0, "product": "D-Link DIR-610", "cisa_kev": "yes", "connections": 2714, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "2e908d84-1758-4d7e-8733-a4d3ac8c6d55", "vulnerability": {"vulnId": "CVE-2025-2775", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e908d84-1758-4d7e-8733-a4d3ac8c6d55", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-05-19T13:18:13+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-05-19T13:18:13+00:00"}, "scope": {"notes": "Affected: SysAid / SysAid On-Premise | Class: device-management-platform | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-14: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-2775", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2775"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "SysAid", "30d_avg": 2, "90d_avg": 1, "product": "SysAid On-Premise", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "8f0cf1e5-d7a0-4c75-99e5-ba327c93402b", "vulnerability": {"vulnId": "CVE-2019-11370", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f0cf1e5-d7a0-4c75-99e5-ba327c93402b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 54}, "timestamps": {"asserted_at": "2023-10-23T04:44:18+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2023-10-23T04:44:18+00:00"}, "scope": {"notes": "Affected: Carel / Carel pCOWeb | Class: embedded-system | Severity: Medium (CVSS 5.4) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11370", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11370"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Carel", "30d_avg": 1, "90d_avg": 0, "product": "Carel pCOWeb", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 5.4, "vulnerability_severity": "Medium"}}]}
{"uuid": "8f821399-3cf0-4533-9091-b1c0d523f684", "vulnerability": {"vulnId": "CVE-2022-22274", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f821399-3cf0-4533-9091-b1c0d523f684", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-12T20:24:49+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2024-09-12T20:24:49+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicOS | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22274"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "12", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 5, "vendor": "SonicWall", "30d_avg": 5, "90d_avg": 52, "product": "SonicOS", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "83be0a50-1c02-42e1-bfed-5c068036154a", "vulnerability": {"vulnId": "CVE-2020-2507", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "83be0a50-1c02-42e1-bfed-5c068036154a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-29T20:09:13+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2024-02-29T20:09:13+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 36", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-2507", "url": "https://www.cve.org/CVERecord?id=CVE-2020-2507"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP QTS", "cisa_kev": "no", "connections": 36, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a670988d-9a6b-440f-a985-598498923f6f", "vulnerability": {"vulnId": "CVE-2025-2777", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a670988d-9a6b-440f-a985-598498923f6f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-05-14T16:37:25+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-05-14T16:37:25+00:00"}, "scope": {"notes": "Affected: SysAid / SysAid On-Premise | Class: device-management-platform | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-2777", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2777"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "SysAid", "30d_avg": 2, "90d_avg": 1, "product": "SysAid On-Premise", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "0666a14c-6144-4bc2-9155-61eef7e24010", "vulnerability": {"vulnId": "CVE-2017-11610", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0666a14c-6144-4bc2-9155-61eef7e24010", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-19T07:48:30+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2023-10-19T07:48:30+00:00"}, "scope": {"notes": "Affected: Supervisor / XML-RPC Server | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-11610", "url": "https://www.cve.org/CVERecord?id=CVE-2017-11610"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Supervisor", "30d_avg": 0, "90d_avg": 0, "product": "XML-RPC Server", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "914cc588-fa60-4d5d-9439-b2d8f68ef58b", "vulnerability": {"vulnId": "CVE-2025-20362", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "914cc588-fa60-4d5d-9439-b2d8f68ef58b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-10-13T09:31:52+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-10-13T09:31:52+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ASA and Cisco Firepower Threat Defense | Class: firewall | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-14: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-20362", "url": "https://www.cve.org/CVERecord?id=CVE-2025-20362"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 0, "product": "Cisco ASA and Cisco Firepower Threat Defense", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "a23349f5-0aa0-4f9f-ade7-52468e9c3c97", "vulnerability": {"vulnId": "CVE-2025-25231", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a23349f5-0aa0-4f9f-ade7-52468e9c3c97", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-12-28T09:58:08+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-12-28T09:58:08+00:00"}, "scope": {"notes": "Affected: Omnissa / Omnissa Workspace ONE UEM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-25231", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25231"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Omnissa", "30d_avg": 2, "90d_avg": 1, "product": "Omnissa Workspace ONE UEM", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "06dfdff2-685b-46f2-bd4c-71b9f7d8d38a", "vulnerability": {"vulnId": "CVE-2024-29972", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "06dfdff2-685b-46f2-bd4c-71b9f7d8d38a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-13T10:29:05+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2026-07-13T10:29:05+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NAS326 and NAS542 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 1585", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-29972", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29972"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Zyxel NAS326 and NAS542", "cisa_kev": "no", "connections": 1585, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "95f6cd85-cb6f-45fc-99fb-837547a64cd6", "vulnerability": {"vulnId": "CVE-2023-0656", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "95f6cd85-cb6f-45fc-99fb-837547a64cd6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-09-12T20:24:49+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2024-09-12T20:24:49+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicOS | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0656", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0656"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "12", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 4, "vendor": "SonicWall", "30d_avg": 5, "90d_avg": 50, "product": "SonicOS", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "424c9732-539a-4cc5-98e5-19d219034d63", "vulnerability": {"vulnId": "CVE-2025-2776", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "424c9732-539a-4cc5-98e5-19d219034d63", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-05-14T16:37:25+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-05-14T16:37:25+00:00"}, "scope": {"notes": "Affected: SysAid / SysAid On-Premise | Class: device-management-platform | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-14: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-2776", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2776"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "SysAid", "30d_avg": 2, "90d_avg": 1, "product": "SysAid On-Premise", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "2eb6ce5e-b62b-45d5-9f89-ab158c1e652b", "vulnerability": {"vulnId": "CVE-2025-26793", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2eb6ce5e-b62b-45d5-9f89-ab158c1e652b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-06-08T20:31:42+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-06-08T20:31:42+00:00"}, "scope": {"notes": "Affected: Hirsch / Hirsch Enterphone MESH | Class: other-software | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-26793", "url": "https://www.cve.org/CVERecord?id=CVE-2025-26793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hirsch", "30d_avg": 2, "90d_avg": 1, "product": "Hirsch Enterphone MESH", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "b1518051-ae51-4bc9-a8cb-01c5a3017a28", "vulnerability": {"vulnId": "CVE-2022-4257", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b1518051-ae51-4bc9-a8cb-01c5a3017a28", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T18:13:45+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2023-10-18T18:13:45+00:00"}, "scope": {"notes": "Affected: C-DATA / C-DATA Web Management System | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-4257", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4257"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "C-DATA", "30d_avg": 0, "90d_avg": 0, "product": "C-DATA Web Management System", "cisa_kev": "no", "connections": 20, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "99a958f3-6830-43b4-9204-d11a6d8685ff", "vulnerability": {"vulnId": "CVE-2023-43177", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "99a958f3-6830-43b4-9204-d11a6d8685ff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-01T04:09:23+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2025-08-01T04:09:23+00:00"}, "scope": {"notes": "Affected: CrushFTP / CrushFTP | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-14: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-43177", "url": "https://www.cve.org/CVERecord?id=CVE-2023-43177"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "CrushFTP", "30d_avg": 0, "90d_avg": 0, "product": "CrushFTP", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fae84844-4b6a-403c-900d-eb6e4270dc97", "vulnerability": {"vulnId": "CVE-2020-36728", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fae84844-4b6a-403c-900d-eb6e4270dc97", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-18T08:10:21+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2025-11-18T08:10:21+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Adning Advertising plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-36728", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36728"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 0, "product": "Wordpress Adning Advertising plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4df2d3ab-8145-4d6b-a9e7-fa45d374ab54", "vulnerability": {"vulnId": "CVE-2021-22017", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4df2d3ab-8145-4d6b-a9e7-fa45d374ab54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-04-21T12:54:50+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2026-04-21T12:54:50+00:00"}, "scope": {"notes": "Affected: VMware / vCenter Server | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22017", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22017"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VMware", "30d_avg": 0, "90d_avg": 0, "product": "vCenter Server", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "5caec942-c9d3-40aa-97c0-b4d94038af7c", "vulnerability": {"vulnId": "CVE-2026-2699", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5caec942-c9d3-40aa-97c0-b4d94038af7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-10T15:34:10+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2026-07-10T15:34:10+00:00"}, "scope": {"notes": "Affected: Progress / Citrix ShareFile StorageZones (aka storage zones) Controller | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-2699", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2699"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 0, "product": "Citrix ShareFile StorageZones (aka storage zones) Controller", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c01c56a9-6864-45f7-ba7b-e4a393c5ff19", "vulnerability": {"vulnId": "CVE-2017-1000028", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c01c56a9-6864-45f7-ba7b-e4a393c5ff19", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-18T18:16:21+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-18T18:16:21+00:00"}, "scope": {"notes": "Affected: Oracle / GlassFish | Class: app-server | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-1000028", "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000028"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "GlassFish", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "5342b3ba-b64a-4013-9e9f-69aaae815362", "vulnerability": {"vulnId": "CVE-2019-9762", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5342b3ba-b64a-4013-9e9f-69aaae815362", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-21T11:58:06+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2024-04-21T11:58:06+00:00"}, "scope": {"notes": "Affected: PHPSHE / PHPSHE | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9762", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9762"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "PHPSHE", "30d_avg": 0, "90d_avg": 0, "product": "PHPSHE", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bfc16a17-9557-45b1-8e88-cb6018bf2594", "vulnerability": {"vulnId": "CVE-2021-43287", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bfc16a17-9557-45b1-8e88-cb6018bf2594", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-17T22:27:33+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-17T22:27:33+00:00"}, "scope": {"notes": "Affected: ThoughtWorks / GoCD | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-43287", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43287"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ThoughtWorks", "30d_avg": 0, "90d_avg": 0, "product": "GoCD", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "2a4d7580-9ee3-4ba4-9a4c-4dde9b26b868", "vulnerability": {"vulnId": "CVE-2022-36553", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2a4d7580-9ee3-4ba4-9a4c-4dde9b26b868", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T20:45:45+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-13T20:45:45+00:00"}, "scope": {"notes": "Affected: Hytec Inter / Hytec Inter HWL-2511-SS | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36553", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36553"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Hytec Inter", "30d_avg": 0, "90d_avg": 0, "product": "Hytec Inter HWL-2511-SS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f042889d-01b2-4100-bda3-aeed9948080e", "vulnerability": {"vulnId": "CVE-2018-7700", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f042889d-01b2-4100-bda3-aeed9948080e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-18T18:15:06+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-18T18:15:06+00:00"}, "scope": {"notes": "Affected: DedeCMS / DedeCMS | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-7700", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7700"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "DedeCMS", "30d_avg": 0, "90d_avg": 0, "product": "DedeCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "36b209aa-5ce2-476e-82b0-749a8a77a608", "vulnerability": {"vulnId": "CVE-2019-8442", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "36b209aa-5ce2-476e-82b0-749a8a77a608", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-17T22:27:41+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-17T22:27:41+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-8442", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8442"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 0, "product": "JIRA", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "38efb772-4ff0-4c1a-bd4f-c1bddd818087", "vulnerability": {"vulnId": "CVE-2026-1281", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "38efb772-4ff0-4c1a-bd4f-c1bddd818087", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-31T10:10:41+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2026-01-31T10:10:41+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1281", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1281"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 0, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c75d49d3-b6fb-408b-8cdc-1fb75db2ff86", "vulnerability": {"vulnId": "CVE-2022-22947", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c75d49d3-b6fb-408b-8cdc-1fb75db2ff86", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-20T16:58:23+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-20T16:58:23+00:00"}, "scope": {"notes": "Affected: Spring / Spring Cloud Gateway | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22947", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22947"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Spring", "30d_avg": 0, "90d_avg": 0, "product": "Spring Cloud Gateway", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "241e3e8c-daee-4758-990e-7cc482d57c81", "vulnerability": {"vulnId": "CVE-2025-53770", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "241e3e8c-daee-4758-990e-7cc482d57c81", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-22T10:21:23+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2025-07-22T10:21:23+00:00"}, "scope": {"notes": "Affected: Microsoft / SharePoint | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 12298", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-53770", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53770"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "17", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 2, "vendor": "Microsoft", "30d_avg": 1, "90d_avg": 0, "product": "SharePoint", "cisa_kev": "yes", "connections": 12298, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "vulnerability": {"vulnId": "CVE-2021-22205", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-26T11:30:51+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-26T11:30:51+00:00"}, "scope": {"notes": "Affected: GitLab / GitLab CE/EE | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22205", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22205"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GitLab", "30d_avg": 0, "90d_avg": 0, "product": "GitLab CE/EE", "cisa_kev": "yes", "connections": 18, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "0a4fe12e-4e38-43f3-8afc-a52cf35efd54", "vulnerability": {"vulnId": "CVE-2013-2678", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0a4fe12e-4e38-43f3-8afc-a52cf35efd54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2025-08-21T07:51:59+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2025-08-21T07:51:59+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys E Series | Class: router | Severity: High (CVSS 8.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-13: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2013-2678", "url": "https://www.cve.org/CVERecord?id=CVE-2013-2678"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Linksys", "30d_avg": 0, "90d_avg": 0, "product": "Linksys E Series", "cisa_kev": "no", "connections": 8, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "e26dde7d-f826-46c8-9cf5-f136b866bd1b", "vulnerability": {"vulnId": "CVE-2017-12149", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e26dde7d-f826-46c8-9cf5-f136b866bd1b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-15T02:27:05+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-15T02:27:05+00:00"}, "scope": {"notes": "Affected: RedHat / JBoss | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-12149", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12149"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "RedHat", "30d_avg": 0, "90d_avg": 0, "product": "JBoss", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4639144a-7403-4411-944e-f04bfe11524d", "vulnerability": {"vulnId": "CVE-2023-3519", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4639144a-7403-4411-944e-f04bfe11524d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-24T22:08:07+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-24T22:08:07+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ADC and Citrix Gateway | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3519", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3519"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 0, "product": "Citrix ADC and Citrix Gateway", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1bcc08f1-16b0-423a-81d1-86022a9fc97d", "vulnerability": {"vulnId": "CVE-2023-22897", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1bcc08f1-16b0-423a-81d1-86022a9fc97d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-23T18:49:49+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-23T18:49:49+00:00"}, "scope": {"notes": "Affected: SecurePoint / SecurePoint UTM | Class: firewall | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22897", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22897"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "SecurePoint", "30d_avg": 0, "90d_avg": 0, "product": "SecurePoint UTM", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "59c1e374-74bb-4c33-b208-e42d6fb9d27e", "vulnerability": {"vulnId": "CVE-2017-8226", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "59c1e374-74bb-4c33-b208-e42d6fb9d27e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-08T16:44:00+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-11-08T16:44:00+00:00"}, "scope": {"notes": "Affected: Amcrest / Amcrest IPM-721S | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-13: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-8226", "url": "https://www.cve.org/CVERecord?id=CVE-2017-8226"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Amcrest", "30d_avg": 0, "90d_avg": 0, "product": "Amcrest IPM-721S", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "70bacad1-ad73-4b63-a971-590680626497", "vulnerability": {"vulnId": "CVE-2021-22214", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "70bacad1-ad73-4b63-a971-590680626497", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2023-10-24T10:23:48+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-24T10:23:48+00:00"}, "scope": {"notes": "Affected: GitLab / GitLab CE/EE | Class: other-software | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22214", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22214"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GitLab", "30d_avg": 0, "90d_avg": 0, "product": "GitLab CE/EE", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}]}
{"uuid": "fe975cb2-5c58-4ecd-9f31-9c5c606e44eb", "vulnerability": {"vulnId": "CVE-2023-27163", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fe975cb2-5c58-4ecd-9f31-9c5c606e44eb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-10-13T10:50:22+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2025-10-13T10:50:22+00:00"}, "scope": {"notes": "Affected: Request Baskets / Request Baskets | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27163", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27163"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Request Baskets", "30d_avg": 0, "90d_avg": 0, "product": "Request Baskets", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "f89b9520-11e0-40be-9870-adce372c2450", "vulnerability": {"vulnId": "CVE-2023-41642", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f89b9520-11e0-40be-9870-adce372c2450", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2024-07-24T07:59:10+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2024-07-24T07:59:10+00:00"}, "scope": {"notes": "Affected: GruppoSCAI / RealGimm | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-41642", "url": "https://www.cve.org/CVERecord?id=CVE-2023-41642"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GruppoSCAI", "30d_avg": 0, "90d_avg": 0, "product": "RealGimm", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "95e87a81-e0c6-4a2d-842b-8f3d5558dc91", "vulnerability": {"vulnId": "EDB-43143", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "95e87a81-e0c6-4a2d-842b-8f3d5558dc91", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T19:00:45+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-13T19:00:45+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link 850L | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-43143", "url": "https://www.exploit-db.com/exploits/43143"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link 850L", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "c641c835-4f29-463b-9b05-3381742aaf79", "vulnerability": {"vulnId": "CVE-2023-27587", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c641c835-4f29-463b-9b05-3381742aaf79", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-23T23:23:29+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-23T23:23:29+00:00"}, "scope": {"notes": "Affected: ReadtoMyShoe / ReadtoMyShoe | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27587", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27587"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ReadtoMyShoe", "30d_avg": 0, "90d_avg": 0, "product": "ReadtoMyShoe", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "4be45097-2db5-40b3-ab46-32a08e355d19", "vulnerability": {"vulnId": "CVE-2022-39960", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4be45097-2db5-40b3-ab46-32a08e355d19", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2023-10-18T18:17:32+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2023-10-18T18:17:32+00:00"}, "scope": {"notes": "Affected: Atlassian / JIRA | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-39960", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39960"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 0, "product": "JIRA", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "3f1f1eaf-44e9-41d0-9b5f-eccdad1fe3a4", "vulnerability": {"vulnId": "CVE-2022-28290", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3f1f1eaf-44e9-41d0-9b5f-eccdad1fe3a4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-05-16T10:01:07+00:00", "recorded_at": "2026-07-15T01:00:01+00:00", "last_seen_at": "2026-07-13T00:00:00+00:00", "first_seen_at": "2026-05-16T10:01:07+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Country Selector plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-13: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28290", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28290"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Country Selector plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "ec355989-90d7-4e7f-8ef7-392ad44c8987", "vulnerability": {"vulnId": "CVE-2023-48022", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ec355989-90d7-4e7f-8ef7-392ad44c8987", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-05T20:47:12+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2024-04-05T20:47:12+00:00"}, "scope": {"notes": "Affected: Anyscale / Ray | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 377", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-48022", "url": "https://www.cve.org/CVERecord?id=CVE-2023-48022"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Anyscale", "30d_avg": 0, "90d_avg": 0, "product": "Ray", "cisa_kev": "no", "connections": 377, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "35ea2332-23e9-4972-bbe5-3218746fd3fd", "vulnerability": {"vulnId": "CVE-2019-10068", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "35ea2332-23e9-4972-bbe5-3218746fd3fd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-29T06:32:03+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2023-11-29T06:32:03+00:00"}, "scope": {"notes": "Affected: Kentico / Kentico | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-12: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-10068", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10068"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Kentico", "30d_avg": 0, "90d_avg": 0, "product": "Kentico", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c260c923-b1be-4835-802b-106ffef2ff70", "vulnerability": {"vulnId": "CVE-2024-50334", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c260c923-b1be-4835-802b-106ffef2ff70", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-07-17T05:16:14+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2025-07-17T05:16:14+00:00"}, "scope": {"notes": "Affected: Erudika / Scoold | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-50334", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50334"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Erudika", "30d_avg": 1, "90d_avg": 0, "product": "Scoold", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "780e8d10-e385-4076-9b87-20db02c6b39c", "vulnerability": {"vulnId": "CVE-2024-11305", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "780e8d10-e385-4076-9b87-20db02c6b39c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2024-12-24T07:06:01+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2024-12-24T07:06:01+00:00"}, "scope": {"notes": "Affected: APsystems / Altenergy Power Control Software | Class: other-software | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-12: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-11305", "url": "https://www.cve.org/CVERecord?id=CVE-2024-11305"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "APsystems", "30d_avg": 0, "90d_avg": 0, "product": "Altenergy Power Control Software", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "ab721c85-2582-4936-8de4-58e7d1f8f0ca", "vulnerability": {"vulnId": "CVE-2025-25034", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ab721c85-2582-4936-8de4-58e7d1f8f0ca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2025-10-26T14:03:30+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2025-10-26T14:03:30+00:00"}, "scope": {"notes": "Affected: SugarCRM / SugarCRM | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-25034", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25034"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "SugarCRM", "30d_avg": 5, "90d_avg": 2, "product": "SugarCRM", "cisa_kev": "no", "connections": 19, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "d6c915fa-0053-49b4-b57e-b90fab0f9a85", "vulnerability": {"vulnId": "CVE-2024-2330", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d6c915fa-0053-49b4-b57e-b90fab0f9a85", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2024-09-26T15:34:13+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2024-09-26T15:34:13+00:00"}, "scope": {"notes": "Affected: Netentsec / NS-ASG Application Security Gateway | Class: firewall | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-2330", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2330"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Netentsec", "30d_avg": 0, "90d_avg": 0, "product": "NS-ASG Application Security Gateway", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e78ede84-80eb-45e5-9b5f-76af9deed268", "vulnerability": {"vulnId": "CVE-2024-7097", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e78ede84-80eb-45e5-9b5f-76af9deed268", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2025-02-02T13:21:23+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2025-02-02T13:21:23+00:00"}, "scope": {"notes": "Affected: WSO2 / WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager | Class: security-management-platform | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7097", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7097"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "WSO2", "30d_avg": 0, "90d_avg": 0, "product": "WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "2368324a-e226-4f5f-b0e2-f44fd238862a", "vulnerability": {"vulnId": "CVE-2025-5605", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2368324a-e226-4f5f-b0e2-f44fd238862a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2025-12-14T10:16:03+00:00", "recorded_at": "2026-07-14T01:00:01+00:00", "last_seen_at": "2026-07-12T00:00:00+00:00", "first_seen_at": "2025-12-14T10:16:03+00:00"}, "scope": {"notes": "Affected: WSO2 / WSO2 multiple products | Class: other-software | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-12: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-5605", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5605"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "WSO2", "30d_avg": 0, "90d_avg": 0, "product": "WSO2 multiple products", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "05254fe1-7b94-4d08-b914-55a722c23bd6", "vulnerability": {"vulnId": "CVE-2020-8958", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "05254fe1-7b94-4d08-b914-55a722c23bd6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-25T14:54:53+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2023-10-25T14:54:53+00:00"}, "scope": {"notes": "Affected: Guangzhou / Guangzhou 1GE ONU (GPON) | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-11: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-8958", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8958"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Guangzhou", "30d_avg": 0, "90d_avg": 0, "product": "Guangzhou 1GE ONU (GPON)", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-11", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "06228a2a-ca57-48cd-976c-68b5112632dc", "vulnerability": {"vulnId": "CVE-2020-17453", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "06228a2a-ca57-48cd-976c-68b5112632dc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-10-23T18:34:28+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2023-10-23T18:34:28+00:00"}, "scope": {"notes": "Affected: WSO2 / WSO2 Management Console | Class: security-management-platform | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-17453", "url": "https://www.cve.org/CVERecord?id=CVE-2020-17453"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "WSO2", "30d_avg": 0, "90d_avg": 0, "product": "WSO2 Management Console", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-11", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "482d60b2-ab4e-4de3-ba90-f5115a1d9262", "vulnerability": {"vulnId": "CVE-2026-48282", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "482d60b2-ab4e-4de3-ba90-f5115a1d9262", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-08T17:11:33+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2026-07-08T17:11:33+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-11: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-48282", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48282"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "d784fd3e-0101-461a-bb5f-50480bb0d3d4", "vulnerability": {"vulnId": "CVE-2026-52813", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d784fd3e-0101-461a-bb5f-50480bb0d3d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-09T14:21:37+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2026-07-09T14:21:37+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-52813", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52813"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6b0761de-a4a9-4d9f-9b05-4edb43dee136", "vulnerability": {"vulnId": "CVE-2026-4020", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b0761de-a4a9-4d9f-9b05-4edb43dee136", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-08T08:28:06+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2026-07-08T08:28:06+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-4020", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4020"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e28acf15-682d-4320-8488-d497ac00f069", "vulnerability": {"vulnId": "CVE-2023-22620", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e28acf15-682d-4320-8488-d497ac00f069", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:57:44+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2023-10-14T14:57:44+00:00"}, "scope": {"notes": "Affected: SecurePoint / SecurePoint UTM | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22620", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22620"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "SecurePoint", "30d_avg": 7, "90d_avg": 4, "product": "SecurePoint UTM", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-11", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "d66d5695-27a9-4af2-98f7-381ccc116980", "vulnerability": {"vulnId": "CVE-2025-26319", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d66d5695-27a9-4af2-98f7-381ccc116980", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-31T18:14:14+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2025-03-31T18:14:14+00:00"}, "scope": {"notes": "Affected: FlowiseAI / Flowise | Class: ai-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-26319", "url": "https://www.cve.org/CVERecord?id=CVE-2025-26319"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "FlowiseAI", "30d_avg": 6, "90d_avg": 3, "product": "Flowise", "cisa_kev": "no", "connections": 6, "observation_date": "2026-07-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b1a38598-9a62-4f1c-932a-c5ed4e8a15e9", "vulnerability": {"vulnId": "CVE-2019-0193", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b1a38598-9a62-4f1c-932a-c5ed4e8a15e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-14T15:22:44+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2023-10-14T15:22:44+00:00"}, "scope": {"notes": "Affected: Apache / Solr | Class: database | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-11: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-0193", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0193"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Solr", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-11", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "fcecfeec-83e7-4b34-9b3e-0f84eeb1e137", "vulnerability": {"vulnId": "CVE-2026-5027", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T15:37:40+00:00"}, "gcve": {"gna": 1, "object_uuid": "fcecfeec-83e7-4b34-9b3e-0f84eeb1e137", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-10T15:37:40+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T15:37:40+00:00", "first_seen_at": "2026-07-10T15:37:40+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-5027", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5027"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "45dd3aae-bfd3-4121-b032-178f7c6f2b4f", "vulnerability": {"vulnId": "CVE-2026-20230", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T05:44:11+00:00"}, "gcve": {"gna": 1, "object_uuid": "45dd3aae-bfd3-4121-b032-178f7c6f2b4f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-10T05:44:11+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T05:44:11+00:00", "first_seen_at": "2026-07-10T05:44:11+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-20230", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20230"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "1d3afc2d-157a-4303-9731-7c570f4be5e9", "vulnerability": {"vulnId": "CVE-2026-39808", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1d3afc2d-157a-4303-9731-7c570f4be5e9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-08T07:31:01+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-07-08T07:31:01+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-39808", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39808"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "8947fdff-5d47-4871-a9fd-c4630831a44e", "vulnerability": {"vulnId": "CVE-2023-3608", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8947fdff-5d47-4871-a9fd-c4630831a44e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-05-05T02:41:19+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2024-05-05T02:41:19+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / Ruijie BCR810W | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-10: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-3608", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3608"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "Ruijie BCR810W", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-10", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f7c27c22-c307-4af0-b813-e6bbe2df7f54", "vulnerability": {"vulnId": "CVE-2026-20253", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f7c27c22-c307-4af0-b813-e6bbe2df7f54", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-09T01:42:12+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-07-09T01:42:12+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-20253", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20253"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "fafeb375-aef3-47c3-83a9-d7a194354ef6", "vulnerability": {"vulnId": "CVE-2026-35273", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fafeb375-aef3-47c3-83a9-d7a194354ef6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-07T12:06:02+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-07-07T12:06:02+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-10: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-35273", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35273"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "4205f4a0-9687-416b-9368-4bf55be1eeb6", "vulnerability": {"vulnId": "CVE-2018-17532", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4205f4a0-9687-416b-9368-4bf55be1eeb6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-02T12:15:40+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2023-11-02T12:15:40+00:00"}, "scope": {"notes": "Affected: Teltonika / Teltonika RUT9XX series | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-10: 47", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-17532", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17532"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 2, "vendor": "Teltonika", "30d_avg": 1, "90d_avg": 0, "product": "Teltonika RUT9XX series", "cisa_kev": "no", "connections": 47, "observation_date": "2026-07-10", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "34ec8177-b8c1-444c-955f-7234284ca382", "vulnerability": {"vulnId": "CVE-2025-29635", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "34ec8177-b8c1-444c-955f-7234284ca382", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-04-27T01:02:53+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-04-27T01:02:53+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-10: 1891", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-29635", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29635"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "yes", "connections": 1891, "observation_date": "2026-07-10", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "a27da8f6-2db3-487b-a9a7-110243974b82", "vulnerability": {"vulnId": "CVE-2026-8037", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a27da8f6-2db3-487b-a9a7-110243974b82", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-07T13:01:13+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-07-07T13:01:13+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-10: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-8037", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8037"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 1, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "4c6bb9b7-2f7a-4d13-a7d0-28d4c4b8a1ab", "vulnerability": {"vulnId": "CVE-2019-17558", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T09:09:09+00:00"}, "gcve": {"gna": 1, "object_uuid": "4c6bb9b7-2f7a-4d13-a7d0-28d4c4b8a1ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-07-09T09:09:09+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T09:09:09+00:00", "first_seen_at": "2026-07-09T09:09:09+00:00"}, "scope": {"notes": "Affected: Apache / Solr | Class: database | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-09: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-17558", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17558"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Solr", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a414f781-9919-45d9-b259-b133197352da", "vulnerability": {"vulnId": "CVE-2023-52163", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a414f781-9919-45d9-b259-b133197352da", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 59}, "timestamps": {"asserted_at": "2025-03-29T12:06:35+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2025-03-29T12:06:35+00:00"}, "scope": {"notes": "Affected: DigiEver / DigiEver DS-2105 Pro | Class: video-system | Severity: Medium (CVSS 5.9) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-09: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-52163", "url": "https://www.cve.org/CVERecord?id=CVE-2023-52163"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "DigiEver", "30d_avg": 0, "90d_avg": 0, "product": "DigiEver DS-2105 Pro", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 5.9, "vulnerability_severity": "Medium"}}]}
{"uuid": "3e8992ff-0824-4310-9ea5-addb7d5118fe", "vulnerability": {"vulnId": "CVE-2024-4040", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3e8992ff-0824-4310-9ea5-addb7d5118fe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-05-14T02:03:34+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2024-05-14T02:03:34+00:00"}, "scope": {"notes": "Affected: CrushFTP / CrushFTP | Class: file-transfer | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-09: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4040", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4040"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "CrushFTP", "30d_avg": 0, "90d_avg": 0, "product": "CrushFTP", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "af8a48e0-856e-4da6-840c-9794df9bf822", "vulnerability": {"vulnId": "CVE-2023-6567", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "af8a48e0-856e-4da6-840c-9794df9bf822", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-07-08T12:10:33+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2026-07-08T12:10:33+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6567", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6567"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-09", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "c7d88ecc-f325-42fe-8c12-0cf516fbca75", "vulnerability": {"vulnId": "CVE-2019-6340", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c7d88ecc-f325-42fe-8c12-0cf516fbca75", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2023-11-15T03:29:50+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2023-11-15T03:29:50+00:00"}, "scope": {"notes": "Affected: Drupal / Drupal | Class: cms | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-09: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-6340", "url": "https://www.cve.org/CVERecord?id=CVE-2019-6340"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Drupal", "30d_avg": 0, "90d_avg": 0, "product": "Drupal", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "564f9074-8de5-42c2-93dc-5aef5a9742af", "vulnerability": {"vulnId": "CVE-2020-16139", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "564f9074-8de5-42c2-93dc-5aef5a9742af", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-06-08T23:54:29+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2025-06-08T23:54:29+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Unified IP Conference Station 7937G | Class: voip | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-16139", "url": "https://www.cve.org/CVERecord?id=CVE-2020-16139"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco Unified IP Conference Station 7937G", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "f8326a46-a223-451d-beb1-06fddc836eec", "vulnerability": {"vulnId": "CVE-2025-54309", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8326a46-a223-451d-beb1-06fddc836eec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-10T02:51:32+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2025-10-10T02:51:32+00:00"}, "scope": {"notes": "Affected: CrushFTP / CrushFTP | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54309", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54309"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "CrushFTP", "30d_avg": 0, "90d_avg": 0, "product": "CrushFTP", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-09", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "88d8813f-d40c-43b8-afe5-d70d62e2a08c", "vulnerability": {"vulnId": "CVE-2018-25126", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "88d8813f-d40c-43b8-afe5-d70d62e2a08c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-20T09:14:15+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-01-20T09:14:15+00:00"}, "scope": {"notes": "Affected: Shenzhen TVT / Shenzhen TVT Digital Technology DVR/NVR/IPC | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 2318", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-25126", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25126"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Shenzhen TVT", "30d_avg": 0, "90d_avg": 0, "product": "Shenzhen TVT Digital Technology DVR/NVR/IPC", "cisa_kev": "no", "connections": 2318, "observation_date": "2026-07-08", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e5f2ea80-e1a4-464f-b55f-d544fac60cd3", "vulnerability": {"vulnId": "CVE-2016-11021", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e5f2ea80-e1a4-464f-b55f-d544fac60cd3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2024-01-26T19:26:10+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2024-01-26T19:26:10+00:00"}, "scope": {"notes": "Affected: D-Link / DCS-930L | Class: video-system | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2283", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-11021", "url": "https://www.cve.org/CVERecord?id=CVE-2016-11021"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "DCS-930L", "cisa_kev": "yes", "connections": 2283, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "73d1bf1f-c2a2-4484-aec7-5d6052eefb69", "vulnerability": {"vulnId": "CVE-2024-54764", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "73d1bf1f-c2a2-4484-aec7-5d6052eefb69", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-28T23:22:58+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2025-06-28T23:22:58+00:00"}, "scope": {"notes": "Affected: ipTIME / ipTIME A2004 | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-54764", "url": "https://www.cve.org/CVERecord?id=CVE-2024-54764"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ipTIME", "30d_avg": 0, "90d_avg": 0, "product": "ipTIME A2004", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "6a9e34fc-690f-4ea3-87a5-2f3267fba967", "vulnerability": {"vulnId": "CVE-2025-28367", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6a9e34fc-690f-4ea3-87a5-2f3267fba967", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-24T22:01:26+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2025-06-24T22:01:26+00:00"}, "scope": {"notes": "Affected: i7MEDIA / mojoPortal | Class: cms | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-28367", "url": "https://www.cve.org/CVERecord?id=CVE-2025-28367"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "i7MEDIA", "30d_avg": 0, "90d_avg": 0, "product": "mojoPortal", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "b2417069-5a23-4487-a0cb-f542e624c383", "vulnerability": {"vulnId": "CVE-2024-54763", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b2417069-5a23-4487-a0cb-f542e624c383", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-28T23:24:49+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2025-06-28T23:24:49+00:00"}, "scope": {"notes": "Affected: ipTIME / ipTIME A2004 | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-54763", "url": "https://www.cve.org/CVERecord?id=CVE-2024-54763"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ipTIME", "30d_avg": 0, "90d_avg": 0, "product": "ipTIME A2004", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "1189b92b-8aa2-49d3-a362-1ea66b60903b", "vulnerability": {"vulnId": "CVE-2025-34054", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1189b92b-8aa2-49d3-a362-1ea66b60903b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-01-19T22:05:52+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-01-19T22:05:52+00:00"}, "scope": {"notes": "Affected: AVTECH / AVTECH IP camera, NVR, DVR products | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 207", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34054", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "AVTECH", "30d_avg": 0, "90d_avg": 0, "product": "AVTECH IP camera, NVR, DVR products", "cisa_kev": "no", "connections": 207, "observation_date": "2026-07-08", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "dd9ddd39-5dca-41b7-8252-27a3366e06f6", "vulnerability": {"vulnId": "CVE-2024-7928", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "dd9ddd39-5dca-41b7-8252-27a3366e06f6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2024-08-29T16:49:59+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2024-08-29T16:49:59+00:00"}, "scope": {"notes": "Affected: FastAdmin / FastAdmin | Class: other-software | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7928", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7928"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "FastAdmin", "30d_avg": 1, "90d_avg": 0, "product": "FastAdmin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "d2ca6966-fb27-42ac-8e30-7d01b3129894", "vulnerability": {"vulnId": "CVE-2023-0552", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d2ca6966-fb27-42ac-8e30-7d01b3129894", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 54}, "timestamps": {"asserted_at": "2023-10-23T18:47:20+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2023-10-23T18:47:20+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Registration Forms plugin | Class: cms | Severity: Medium (CVSS 5.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0552", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0552"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Registration Forms plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 5.4, "vulnerability_severity": "Medium"}}]}
{"uuid": "7714e0a2-efb9-4af6-a6c1-fad6f0afbf11", "vulnerability": {"vulnId": "CVE-2014-9118", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "7714e0a2-efb9-4af6-a6c1-fad6f0afbf11", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-01-22T22:47:29+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2024-01-22T22:47:29+00:00"}, "scope": {"notes": "Affected: Zhone / zNID GPON 2426A | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-9118", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9118"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Zhone", "30d_avg": 0, "90d_avg": 0, "product": "zNID GPON 2426A", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ceb03577-7cc6-4c91-bf09-ec47f5c64748", "vulnerability": {"vulnId": "CVE-2024-4841", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ceb03577-7cc6-4c91-bf09-ec47f5c64748", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 33}, "timestamps": {"asserted_at": "2026-03-11T07:12:50+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-11T07:12:50+00:00"}, "scope": {"notes": "Affected: parisneo / lollms-webui | Class: ai-system | Severity: Low (CVSS 3.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-4841", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4841"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "parisneo", "30d_avg": 1, "90d_avg": 0, "product": "lollms-webui", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 3.3, "vulnerability_severity": "Low"}}]}
{"uuid": "b60cc3a5-a4db-4801-90ed-5ae5315258ec", "vulnerability": {"vulnId": "CVE-2024-51567", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b60cc3a5-a4db-4801-90ed-5ae5315258ec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-11-01T22:05:13+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2024-11-01T22:05:13+00:00"}, "scope": {"notes": "Affected: CyberPanel / CyberPanel | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-51567", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51567"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CyberPanel", "30d_avg": 0, "90d_avg": 0, "product": "CyberPanel", "cisa_kev": "yes", "connections": 9, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "841b2945-1545-47e7-ac96-2c90ddbc342d", "vulnerability": {"vulnId": "CVE-2025-10211", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "841b2945-1545-47e7-ac96-2c90ddbc342d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-01-31T16:30:54+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-01-31T16:30:54+00:00"}, "scope": {"notes": "Affected: ChanCMS / ChanCMS | Class: cms | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-10211", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10211"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ChanCMS", "30d_avg": 0, "90d_avg": 0, "product": "ChanCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "406e4afe-4fbb-4c55-86f0-8741f2f59c31", "vulnerability": {"vulnId": "CVE-2021-40822", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "406e4afe-4fbb-4c55-86f0-8741f2f59c31", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-15T08:28:10+00:00", "recorded_at": "2026-07-09T01:00:01+00:00", "last_seen_at": "2026-07-07T00:00:00+00:00", "first_seen_at": "2023-10-15T08:28:10+00:00"}, "scope": {"notes": "Affected: GeoServer / GeoServer | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-07: 30", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-40822", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40822"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GeoServer", "30d_avg": 1, "90d_avg": 0, "product": "GeoServer", "cisa_kev": "no", "connections": 30, "observation_date": "2026-07-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "26148c9b-a1ed-4471-aa8b-b797e07433c1", "vulnerability": {"vulnId": "CVE-2025-3415", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "26148c9b-a1ed-4471-aa8b-b797e07433c1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2025-08-07T09:08:13+00:00", "recorded_at": "2026-07-09T01:00:01+00:00", "last_seen_at": "2026-07-07T00:00:00+00:00", "first_seen_at": "2025-08-07T09:08:13+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-07: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-3415", "url": "https://www.cve.org/CVERecord?id=CVE-2025-3415"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 0, "vendor": "Grafana", "30d_avg": 0, "90d_avg": 0, "product": "Grafana", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-07", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e63a5385-e824-4089-b85c-05b6168f8f83", "vulnerability": {"vulnId": "CVE-2024-28734", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e63a5385-e824-4089-b85c-05b6168f8f83", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-04-27T04:54:55+00:00", "recorded_at": "2026-07-09T01:00:01+00:00", "last_seen_at": "2026-07-07T00:00:00+00:00", "first_seen_at": "2024-04-27T04:54:55+00:00"}, "scope": {"notes": "Affected: Unit4 / Unit4 Financials by Coda | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-07: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-28734", "url": "https://www.cve.org/CVERecord?id=CVE-2024-28734"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Unit4", "30d_avg": 0, "90d_avg": 0, "product": "Unit4 Financials by Coda", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-07", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "96877856-daf6-4ad0-aaac-af33d80c02f7", "vulnerability": {"vulnId": "CVE-2024-9474", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "96877856-daf6-4ad0-aaac-af33d80c02f7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-11-19T18:39:37+00:00", "recorded_at": "2026-07-09T01:00:01+00:00", "last_seen_at": "2026-07-07T00:00:00+00:00", "first_seen_at": "2024-11-19T18:39:37+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / PAN-OS | Class: firewall | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-07: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9474", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9474"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Palo Alto Networks", "30d_avg": 0, "90d_avg": 0, "product": "PAN-OS", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-07-07", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "95e5e2f3-8d94-4e50-8183-b1a62bac8d79", "vulnerability": {"vulnId": "CVE-2024-30269", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "95e5e2f3-8d94-4e50-8183-b1a62bac8d79", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2025-06-28T23:22:52+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T00:00:00+00:00", "first_seen_at": "2025-06-28T23:22:52+00:00"}, "scope": {"notes": "Affected: DataEase / DataEase | Class: business-intelligence | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-30269", "url": "https://www.cve.org/CVERecord?id=CVE-2024-30269"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 0, "vendor": "DataEase", "30d_avg": 0, "90d_avg": 0, "product": "DataEase", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "96ba7fbb-3b03-4ab1-8d14-f0a4c1aef8ee", "vulnerability": {"vulnId": "CVE-2025-27112", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "96ba7fbb-3b03-4ab1-8d14-f0a4c1aef8ee", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2025-06-24T04:31:29+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T00:00:00+00:00", "first_seen_at": "2025-06-24T04:31:29+00:00"}, "scope": {"notes": "Affected: Navidrome / Navidrome | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-27112", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27112"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Navidrome", "30d_avg": 0, "90d_avg": 0, "product": "Navidrome", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "155e19a1-60b9-4051-9d52-88b9b3c242d5", "vulnerability": {"vulnId": "CVE-2022-37061", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "155e19a1-60b9-4051-9d52-88b9b3c242d5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-08-01T00:06:20+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T00:00:00+00:00", "first_seen_at": "2025-08-01T00:06:20+00:00"}, "scope": {"notes": "Affected: FLIR / AX8 thermal sensor cameras | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-06: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-37061", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37061"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "FLIR", "30d_avg": 0, "90d_avg": 0, "product": "AX8 thermal sensor cameras", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "aa44165a-2482-471c-b371-77029ee4fd78", "vulnerability": {"vulnId": "CVE-2024-22927", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aa44165a-2482-471c-b371-77029ee4fd78", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-04-21T11:16:38+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T00:00:00+00:00", "first_seen_at": "2026-04-21T11:16:38+00:00"}, "scope": {"notes": "Affected: weng-xianhu / EyouCMS | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22927", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22927"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "weng-xianhu", "30d_avg": 0, "90d_avg": 0, "product": "EyouCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "9f727329-2506-442e-918e-5bcc7ac4f62c", "vulnerability": {"vulnId": "CVE-2025-24813", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9f727329-2506-442e-918e-5bcc7ac4f62c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 55}, "timestamps": {"asserted_at": "2025-03-14T20:37:01+00:00", "recorded_at": "2026-07-07T01:00:02+00:00", "last_seen_at": "2026-07-05T00:00:00+00:00", "first_seen_at": "2025-03-14T20:37:01+00:00"}, "scope": {"notes": "Affected: Apache / Tomcat | Class: web-server | Severity: Medium (CVSS 5.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-05: 53", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-24813", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24813"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Tomcat", "cisa_kev": "yes", "connections": 53, "observation_date": "2026-07-05", "vulnerability_class": "CVSS", "vulnerability_score": 5.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "eb923112-e4b3-4b7d-98aa-3ce836ec6d44", "vulnerability": {"vulnId": "CVE-2023-34362", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "eb923112-e4b3-4b7d-98aa-3ce836ec6d44", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-20T16:30:39+00:00", "recorded_at": "2026-07-06T01:00:01+00:00", "last_seen_at": "2026-07-04T00:00:00+00:00", "first_seen_at": "2023-10-20T16:30:39+00:00"}, "scope": {"notes": "Affected: Progress / MOVEit Transfer | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-04: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-34362", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34362"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 0, "product": "MOVEit Transfer", "cisa_kev": "yes", "connections": 10, "observation_date": "2026-07-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cca3a384-9b15-48bd-825a-f114eb798b33", "vulnerability": {"vulnId": "CVE-2024-13982", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cca3a384-9b15-48bd-825a-f114eb798b33", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-09-27T04:21:16+00:00", "recorded_at": "2026-07-06T01:00:01+00:00", "last_seen_at": "2026-07-04T00:00:00+00:00", "first_seen_at": "2025-09-27T04:21:16+00:00"}, "scope": {"notes": "Affected: Changsha SPON Communication Technology / SPON IP Network Broadcast System | Class: voip | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13982", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13982"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Changsha SPON Communication Technology", "30d_avg": 0, "90d_avg": 0, "product": "SPON IP Network Broadcast System", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-04", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "6604dbd3-3fbc-4f24-8bdd-bab615230339", "vulnerability": {"vulnId": "CVE-2020-28188", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6604dbd3-3fbc-4f24-8bdd-bab615230339", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:53+00:00", "recorded_at": "2026-07-06T01:00:01+00:00", "last_seen_at": "2026-07-04T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:53+00:00"}, "scope": {"notes": "Affected: TerraMaster / TOS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-28188", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28188"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "TerraMaster", "30d_avg": 0, "90d_avg": 0, "product": "TOS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "16034424-7724-489a-9f4b-402d46f85cbc", "vulnerability": {"vulnId": "CVE-2022-25322", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "16034424-7724-489a-9f4b-402d46f85cbc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:57+00:00", "recorded_at": "2026-07-06T01:00:01+00:00", "last_seen_at": "2026-07-04T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:57+00:00"}, "scope": {"notes": "Affected: ZEROF / ZEROF Web Server | Class: web-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25322", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25322"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "ZEROF", "30d_avg": 0, "90d_avg": 0, "product": "ZEROF Web Server", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2b37f677-af00-4733-8c60-90b989e7598f", "vulnerability": {"vulnId": "CVE-2020-5776", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2b37f677-af00-4733-8c60-90b989e7598f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T14:56:55+00:00", "recorded_at": "2026-07-06T01:00:01+00:00", "last_seen_at": "2026-07-04T00:00:00+00:00", "first_seen_at": "2023-10-14T14:56:55+00:00"}, "scope": {"notes": "Affected: Magento / Magento Mass Import (MAGMI) plugin | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-5776", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5776"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Magento", "30d_avg": 6, "90d_avg": 3, "product": "Magento Mass Import (MAGMI) plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b82e6d59-2cf9-44dc-8b8d-09ccd4f08699", "vulnerability": {"vulnId": "CVE-2026-1125", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T12:35:18+00:00"}, "gcve": {"gna": 1, "object_uuid": "b82e6d59-2cf9-44dc-8b8d-09ccd4f08699", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-02T12:35:18+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T12:35:18+00:00", "first_seen_at": "2026-07-02T12:35:18+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-02: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1125", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1125"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f1cbc51e-dd34-444c-b7dd-d44caf81f394", "vulnerability": {"vulnId": "CVE-2024-5910", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f1cbc51e-dd34-444c-b7dd-d44caf81f394", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-16T17:19:38+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T00:00:00+00:00", "first_seen_at": "2024-12-16T17:19:38+00:00"}, "scope": {"notes": "Affected: Palo Alto Networks / Palo Alto Networks Expedition | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-02: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-5910", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5910"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Palo Alto Networks", "30d_avg": 0, "90d_avg": 0, "product": "Palo Alto Networks Expedition", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "85c8c946-05ed-4751-a445-9d7d88c4b432", "vulnerability": {"vulnId": "CVE-2025-29927", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "85c8c946-05ed-4751-a445-9d7d88c4b432", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2025-04-24T10:37:49+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T00:00:00+00:00", "first_seen_at": "2025-04-24T10:37:49+00:00"}, "scope": {"notes": "Affected: Next.js / Next.js | Class: web-app-framework | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-02: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-29927", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29927"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Next.js", "30d_avg": 0, "90d_avg": 0, "product": "Next.js", "cisa_kev": "no", "connections": 10, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "cc9a7416-c67e-4f8c-89a0-9f438d3d884a", "vulnerability": {"vulnId": "CVE-2017-12542", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc9a7416-c67e-4f8c-89a0-9f438d3d884a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-30T13:11:03+00:00", "recorded_at": "2026-07-03T01:00:01+00:00", "last_seen_at": "2026-07-01T00:00:00+00:00", "first_seen_at": "2026-06-30T13:11:03+00:00"}, "scope": {"notes": "Affected: HP / HP iLO 4 | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-01: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-12542", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12542"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HP", "30d_avg": 0, "90d_avg": 0, "product": "HP iLO 4", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-01", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "1a9e514b-f194-4caa-b0ad-cb62c62919bb", "vulnerability": {"vulnId": "CVE-2022-22963", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1a9e514b-f194-4caa-b0ad-cb62c62919bb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-07T05:56:09+00:00", "recorded_at": "2026-07-03T01:00:01+00:00", "last_seen_at": "2026-07-01T00:00:00+00:00", "first_seen_at": "2023-11-07T05:56:09+00:00"}, "scope": {"notes": "Affected: Spring / Spring Cloud Function | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-01: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22963", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22963"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Spring", "30d_avg": 0, "90d_avg": 0, "product": "Spring Cloud Function", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0756eda0-0d0b-498f-9439-87e698cded02", "vulnerability": {"vulnId": "CVE-2024-36991", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0756eda0-0d0b-498f-9439-87e698cded02", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-11-03T07:55:59+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2024-11-03T07:55:59+00:00"}, "scope": {"notes": "Affected: Splunk / Splunk Enterprise on Windows | Class: database | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-36991", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36991"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Splunk", "30d_avg": 0, "90d_avg": 0, "product": "Splunk Enterprise on Windows", "cisa_kev": "no", "connections": 6, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "4f940b21-d054-4a73-a217-234b522367c0", "vulnerability": {"vulnId": "CVE-2020-10199", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4f940b21-d054-4a73-a217-234b522367c0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-18T18:19:27+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2023-10-18T18:19:27+00:00"}, "scope": {"notes": "Affected: Sonatype / Nexus Repository Manager | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-06-30: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10199", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10199"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Sonatype", "30d_avg": 0, "90d_avg": 0, "product": "Nexus Repository Manager", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "1b1627e2-8b5e-45e6-9876-24c085f1dac0", "vulnerability": {"vulnId": "CVE-2024-53944", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "1b1627e2-8b5e-45e6-9876-24c085f1dac0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-02T20:42:40+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2025-07-02T20:42:40+00:00"}, "scope": {"notes": "Affected: Tuoshi/Dionlink / Tuoshi/Dionlink LT15D 4G Wi-Fi | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-30: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-53944", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53944"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tuoshi/Dionlink", "30d_avg": 0, "90d_avg": 0, "product": "Tuoshi/Dionlink LT15D 4G Wi-Fi", "cisa_kev": "no", "connections": 13, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "de117342-a74e-4615-b114-860b91839be2", "vulnerability": {"vulnId": "CVE-2024-13981", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "de117342-a74e-4615-b114-860b91839be2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-22T02:53:48+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2025-10-22T02:53:48+00:00"}, "scope": {"notes": "Affected: Fujian Apex Software / LiveBOS | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13981", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13981"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Fujian Apex Software", "30d_avg": 0, "90d_avg": 0, "product": "LiveBOS", "cisa_kev": "no", "connections": 5, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "def952ad-425d-486a-a337-5c2ae438bfbf", "vulnerability": {"vulnId": "CVE-2018-13315", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-29T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "def952ad-425d-486a-a337-5c2ae438bfbf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-05T15:22:18+00:00", "recorded_at": "2026-07-01T05:19:58+00:00", "last_seen_at": "2026-06-29T00:00:00+00:00", "first_seen_at": "2024-02-05T15:22:18+00:00"}, "scope": {"notes": "Affected: Totolink / A3002RU | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-29: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-13315", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13315"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "A3002RU", "cisa_kev": "no", "connections": 2, "observation_date": "2026-06-29", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8f9e3217-e281-4805-afa8-75199e24a1ab", "vulnerability": {"vulnId": "CVE-2023-22952", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-27T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f9e3217-e281-4805-afa8-75199e24a1ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-28T14:25:32+00:00", "recorded_at": "2026-06-30T15:47:38+00:00", "last_seen_at": "2026-06-27T00:00:00+00:00", "first_seen_at": "2023-10-28T14:25:32+00:00"}, "scope": {"notes": "Affected: SugarCRM / SugarCRM | Class: other-software | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-06-27: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-22952", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22952"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SugarCRM", "30d_avg": 0, "90d_avg": 0, "product": "SugarCRM", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-06-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "b190c574-a61d-49ed-afb3-869ca84cb882", "vulnerability": {"vulnId": "CVE-2025-34033", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-27T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b190c574-a61d-49ed-afb3-869ca84cb882", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-06-07T19:06:22+00:00", "recorded_at": "2026-06-30T15:47:38+00:00", "last_seen_at": "2026-06-27T00:00:00+00:00", "first_seen_at": "2026-06-07T19:06:22+00:00"}, "scope": {"notes": "Affected: 5VTechnologies / Blue Angel Software Suite | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-27: 100", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34033", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34033"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "5VTechnologies", "30d_avg": 0, "90d_avg": 0, "product": "Blue Angel Software Suite", "cisa_kev": "no", "connections": 100, "observation_date": "2026-06-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "d1683ee2-227b-4228-9226-d64a61d93fca", "vulnerability": {"vulnId": "CVE-2026-36356", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-25T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d1683ee2-227b-4228-9226-d64a61d93fca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2026-06-21T06:44:37+00:00", "recorded_at": "2026-06-30T15:47:38+00:00", "last_seen_at": "2026-06-25T00:00:00+00:00", "first_seen_at": "2026-06-21T06:44:37+00:00"}, "scope": {"notes": "Affected: MeiG / MeiG Smart FORGE_SLT711 | Class: router | Severity: Critical (CVSS 9.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-25: 31", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "MeiG", "30d_avg": 0, "90d_avg": 0, "product": "MeiG Smart FORGE_SLT711", "cisa_kev": "no", "connections": 31, "observation_date": "2026-06-25", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "b93f06a6-fb1c-4c2c-b49a-97a2d49dbb46", "vulnerability": {"vulnId": "CVE-2024-21683", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-22T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b93f06a6-fb1c-4c2c-b49a-97a2d49dbb46", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 83}, "timestamps": {"asserted_at": "2024-05-29T10:27:11+00:00", "recorded_at": "2026-06-30T12:41:52+00:00", "last_seen_at": "2026-06-22T00:00:00+00:00", "first_seen_at": "2024-05-29T10:27:11+00:00"}, "scope": {"notes": "Affected: Atlassian / Confluence | Class: other-software | Severity: High (CVSS 8.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-22: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21683", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21683"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Atlassian", "30d_avg": 0, "90d_avg": 0, "product": "Confluence", "cisa_kev": "no", "connections": 17, "observation_date": "2026-06-22", "vulnerability_class": "CVSS", "vulnerability_score": 8.3, "vulnerability_severity": "High"}}]}
{"uuid": "d912f242-62bf-4dc1-8f22-183da0d8e4b3", "vulnerability": {"vulnId": "CVE-2026-1340", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-19T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d912f242-62bf-4dc1-8f22-183da0d8e4b3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-26T00:27:43+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-06-19T00:00:00+00:00", "first_seen_at": "2026-04-26T00:27:43+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-06-19: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-1340", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1340"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 0, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-06-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "775fb1e1-01a5-48b8-885b-907b95e11c08", "vulnerability": {"vulnId": "CVE-2021-22054", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-15T15:16:56+00:00"}, "gcve": {"gna": 1, "object_uuid": "775fb1e1-01a5-48b8-885b-907b95e11c08", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-15T15:16:56+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-15T15:16:56+00:00", "first_seen_at": "2026-05-15T15:16:56+00:00"}, "scope": {"notes": "Affected: Omnissa / Omnissa Workspace ONE UEM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-05-15: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-22054", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Omnissa", "30d_avg": 0, "90d_avg": 0, "product": "Omnissa Workspace ONE UEM", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-05-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "8967e486-ec9b-4b3a-a500-4e8967e3137c", "vulnerability": {"vulnId": "CVE-2019-13396", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-11T14:26:48+00:00"}, "gcve": {"gna": 1, "object_uuid": "8967e486-ec9b-4b3a-a500-4e8967e3137c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-05-11T14:26:48+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-11T14:26:48+00:00", "first_seen_at": "2026-05-11T14:26:48+00:00"}, "scope": {"notes": "Affected: FlightPath / FlightPath | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-13396", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13396"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "FlightPath", "30d_avg": 0, "90d_avg": 0, "product": "FlightPath", "cisa_kev": "no", "connections": 2, "observation_date": "2026-05-11", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "e604f905-b579-45fc-9723-c484a008b959", "vulnerability": {"vulnId": "CVE-2026-3965", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e604f905-b579-45fc-9723-c484a008b959", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-04-06T15:52:30+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-06T00:00:00+00:00", "first_seen_at": "2026-04-06T15:52:30+00:00"}, "scope": {"notes": "Affected: whyour / qinglong | Class: device-management-platform | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-06: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-3965", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3965"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 4, "vendor": "whyour", "30d_avg": 2, "90d_avg": 0, "product": "qinglong", "cisa_kev": "no", "connections": 1, "observation_date": "2026-05-06", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "81cf0ee7-9392-44fe-a343-c3d5f88cfead", "vulnerability": {"vulnId": "CVE-2025-34058", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-03T16:22:57+00:00"}, "gcve": {"gna": 1, "object_uuid": "81cf0ee7-9392-44fe-a343-c3d5f88cfead", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-05-03T16:22:57+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-03T16:22:57+00:00", "first_seen_at": "2026-05-03T16:22:57+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision Streaming Media Management Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-03: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34058", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34058"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Hikvision Streaming Media Management Server", "cisa_kev": "no", "connections": 3, "observation_date": "2026-05-03", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a254cf21-312f-4045-86b0-7b69f773d42d", "vulnerability": {"vulnId": "CVE-2023-39964", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a254cf21-312f-4045-86b0-7b69f773d42d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-06T15:15:06+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-04-16T00:00:00+00:00", "first_seen_at": "2026-04-06T15:15:06+00:00"}, "scope": {"notes": "Affected: 1Panel / !Panel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-04-16: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-39964", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39964"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "1Panel", "30d_avg": 0, "90d_avg": 0, "product": "!Panel", "cisa_kev": "no", "connections": 1, "observation_date": "2026-04-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "00cb1b7c-1847-4d20-8dd5-dd1fd518c0c6", "vulnerability": {"vulnId": "CVE-2024-22768", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-12T22:07:42+00:00"}, "gcve": {"gna": 1, "object_uuid": "00cb1b7c-1847-4d20-8dd5-dd1fd518c0c6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-12T22:07:42+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-04-12T22:07:42+00:00", "first_seen_at": "2026-04-12T22:07:42+00:00"}, "scope": {"notes": "Affected: Hitron Systems / Hitron Systems DVR | Class: video-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-04-12: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22768", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22768"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Hitron Systems", "30d_avg": 0, "90d_avg": 0, "product": "Hitron Systems DVR", "cisa_kev": "no", "connections": 1, "observation_date": "2026-04-12", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "bc09eed3-d39f-489c-a0f4-81e09ce314a5", "vulnerability": {"vulnId": "CVE-2018-0125", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-02T18:11:50+00:00"}, "gcve": {"gna": 1, "object_uuid": "bc09eed3-d39f-489c-a0f4-81e09ce314a5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-02T18:11:50+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2026-04-02T18:11:50+00:00", "first_seen_at": "2026-04-02T18:11:50+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV132W/RV134W | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2023-05-25: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-0125", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0125"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco RV132W/RV134W", "cisa_kev": "yes", "connections": 2, "observation_date": "2023-05-25", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "68c84b40-0817-4ba4-8223-b2429acc5f7c", "vulnerability": {"vulnId": "CVE-2026-21902", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-20T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "68c84b40-0817-4ba4-8223-b2429acc5f7c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-14T11:28:11+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-20T00:00:00+00:00", "first_seen_at": "2026-03-14T11:28:11+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS Evolved on PTX Series | Class: embedded-system | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-03-20: 45", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-21902", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21902"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 1, "vendor": "Juniper", "30d_avg": 0, "90d_avg": 0, "product": "Junos OS Evolved on PTX Series", "cisa_kev": "no", "connections": 45, "observation_date": "2026-03-20", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}]}
{"uuid": "e56c0a2d-7130-42eb-8cc3-e9266451a0a3", "vulnerability": {"vulnId": "CVE-2026-20128", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-20T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e56c0a2d-7130-42eb-8cc3-e9266451a0a3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-03-06T22:35:44+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-20T00:00:00+00:00", "first_seen_at": "2026-03-06T22:35:44+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco SD-WAN Manager | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-03-20: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-20128", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20128"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 0, "product": "Cisco SD-WAN Manager", "cisa_kev": "no", "connections": 11, "observation_date": "2026-03-20", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "fe63afb1-2c23-4e58-a13a-e7d6dea92ec8", "vulnerability": {"vulnId": "CVE-2024-30891", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-20T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fe63afb1-2c23-4e58-a13a-e7d6dea92ec8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-12-21T05:23:17+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-20T00:00:00+00:00", "first_seen_at": "2025-12-21T05:23:17+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda AC18 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-03-20: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-30891", "url": "https://www.cve.org/CVERecord?id=CVE-2024-30891"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda AC18", "cisa_kev": "no", "connections": 10, "observation_date": "2026-03-20", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "e9f030ab-35d7-4be6-84b8-687962f503b2", "vulnerability": {"vulnId": "CVE-2018-25120", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e9f030ab-35d7-4be6-84b8-687962f503b2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-24T23:13:26+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-08T00:00:00+00:00", "first_seen_at": "2026-02-24T23:13:26+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DNS-343 ShareCenter | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-03-08: 193", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-25120", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25120"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DNS-343 ShareCenter", "cisa_kev": "no", "connections": 193, "observation_date": "2026-03-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "764f4347-53a7-4d8e-a8ac-44e4811eba88", "vulnerability": {"vulnId": "CVE-2025-5571", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "764f4347-53a7-4d8e-a8ac-44e4811eba88", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-23T00:54:38+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-23T00:54:38+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DCS-932L | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-5571", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5571"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DCS-932L", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ff7de19c-bf2e-4766-96ea-f32d1541a319", "vulnerability": {"vulnId": "CVE-2025-7081", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff7de19c-bf2e-4766-96ea-f32d1541a319", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-23T01:49:02+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-23T01:49:02+00:00"}, "scope": {"notes": "Affected: Belkin / Belkin F9K1122 | Class: wireless-extender | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-7081", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7081"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "Belkin", "30d_avg": 0, "90d_avg": 0, "product": "Belkin F9K1122", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "b0e75a8f-0a43-481d-9d8c-fe40cdbf0e28", "vulnerability": {"vulnId": "CVE-2025-6485", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b0e75a8f-0a43-481d-9d8c-fe40cdbf0e28", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-01-22T20:22:46+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-22T20:22:46+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A3002R | Class: router | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-6485", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6485"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A3002R", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "154c9e89-a183-4b48-8d79-58e240004b19", "vulnerability": {"vulnId": "CVE-2025-8829", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "154c9e89-a183-4b48-8d79-58e240004b19", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-22T23:05:14+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-22T23:05:14+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 | Class: wireless-extender | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-8829", "url": "https://www.cve.org/CVERecord?id=CVE-2025-8829"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "Linksys", "30d_avg": 0, "90d_avg": 0, "product": "Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "de96b1ed-57a8-4d1c-876c-bb47289590eb", "vulnerability": {"vulnId": "CVE-2025-7407", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "de96b1ed-57a8-4d1c-876c-bb47289590eb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-22T21:15:32+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-22T21:15:32+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR D6400 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-7407", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7407"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 0, "90d_avg": 0, "product": "NETGEAR D6400", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "182f17a7-cabe-4430-a1b9-f7e684a73a5b", "vulnerability": {"vulnId": "CVE-2025-44846", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "182f17a7-cabe-4430-a1b9-f7e684a73a5b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-01-29T10:41:36+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-29T10:41:36+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink CA600-PoE | Class: router | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-44846", "url": "https://www.cve.org/CVERecord?id=CVE-2025-44846"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink CA600-PoE", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "63005d29-cf03-4141-9c5e-04ca5b78b636", "vulnerability": {"vulnId": "CVE-2022-40619", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "63005d29-cf03-4141-9c5e-04ca5b78b636", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 77}, "timestamps": {"asserted_at": "2026-01-26T20:12:10+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-11T00:00:00+00:00", "first_seen_at": "2026-01-26T20:12:10+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR devices with FunJSQ | Class: router | Severity: High (CVSS 7.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-11: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40619", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40619"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 0, "90d_avg": 0, "product": "NETGEAR devices with FunJSQ", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-11", "vulnerability_class": "CVSS", "vulnerability_score": 7.7, "vulnerability_severity": "High"}}]}
{"uuid": "f6744a68-c102-4381-adfc-4e0b59f70c31", "vulnerability": {"vulnId": "CVE-2022-31208", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f6744a68-c102-4381-adfc-4e0b59f70c31", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-22T08:58:28+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-10T00:00:00+00:00", "first_seen_at": "2026-01-22T08:58:28+00:00"}, "scope": {"notes": "Affected: Infiray / Infiray IRAY-A8Z3 | Class: other-software | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-10: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31208", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31208"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Infiray", "30d_avg": 0, "90d_avg": 0, "product": "Infiray IRAY-A8Z3", "cisa_kev": "no", "connections": 6, "observation_date": "2026-02-10", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "061ad775-dc3f-4db7-a214-7f9bed77a3b1", "vulnerability": {"vulnId": "CVE-2015-10145", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "061ad775-dc3f-4db7-a214-7f9bed77a3b1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-01-31T14:30:16+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-10T00:00:00+00:00", "first_seen_at": "2026-01-31T14:30:16+00:00"}, "scope": {"notes": "Affected: Gargoyle / Gargoyle Router | Class: router | Severity: High (CVSS 8.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-10: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-10145", "url": "https://www.cve.org/CVERecord?id=CVE-2015-10145"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Gargoyle", "30d_avg": 0, "90d_avg": 0, "product": "Gargoyle Router", "cisa_kev": "no", "connections": 7, "observation_date": "2026-02-10", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}]}
{"uuid": "12ce1d79-c572-418b-812c-8da2125e4eb3", "vulnerability": {"vulnId": "CVE-2025-34042", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-09T23:23:54+00:00"}, "gcve": {"gna": 1, "object_uuid": "12ce1d79-c572-418b-812c-8da2125e4eb3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2026-02-09T23:23:54+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-09T23:23:54+00:00", "first_seen_at": "2026-02-09T23:23:54+00:00"}, "scope": {"notes": "Affected: BEWARD / BEWARD N100 H.264 VGA IP Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-09: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-34042", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34042"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "BEWARD", "30d_avg": 0, "90d_avg": 0, "product": "BEWARD N100 H.264 VGA IP Camera", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-09", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "9b9f47b0-5634-477f-a78c-e22d85c502a7", "vulnerability": {"vulnId": "CVE-2022-34538", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9b9f47b0-5634-477f-a78c-e22d85c502a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-25T01:59:00+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-09T00:00:00+00:00", "first_seen_at": "2026-01-25T01:59:00+00:00"}, "scope": {"notes": "Affected: Digital Watchdog / Digital Watchdog DW MEGApix IP cameras | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-09: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-34538", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34538"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Digital Watchdog", "30d_avg": 0, "90d_avg": 0, "product": "Digital Watchdog DW MEGApix IP cameras", "cisa_kev": "no", "connections": 10, "observation_date": "2026-02-09", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "d5b62869-c683-4840-bb96-aed1c7dc2fe7", "vulnerability": {"vulnId": "CVE-2020-11963", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d5b62869-c683-4840-bb96-aed1c7dc2fe7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-23T11:38:39+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-07T00:00:00+00:00", "first_seen_at": "2026-01-23T11:38:39+00:00"}, "scope": {"notes": "Affected: Evenroute / IQrouter | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-07: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-11963", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11963"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Evenroute", "30d_avg": 0, "90d_avg": 0, "product": "IQrouter", "cisa_kev": "no", "connections": 11, "observation_date": "2026-02-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "86891208-3138-4683-80ce-fec97cc1aea3", "vulnerability": {"vulnId": "CVE-2020-24219", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-04T16:36:18+00:00"}, "gcve": {"gna": 1, "object_uuid": "86891208-3138-4683-80ce-fec97cc1aea3", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-02-04T16:36:18+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2026-02-04T16:36:18+00:00", "first_seen_at": "2026-02-04T16:36:18+00:00"}, "scope": {"notes": "Affected: HiSilicon / HiSilicon based hardware video encoders (multiple vendors) | Class: embedded-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-07-26: 191", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-24219", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24219"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "HiSilicon", "30d_avg": 0, "90d_avg": 0, "product": "HiSilicon based hardware video encoders (multiple vendors)", "cisa_kev": "no", "connections": 191, "observation_date": "2023-07-26", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "e43e5d7e-3f98-4df5-aff8-a79553d32660", "vulnerability": {"vulnId": "CVE-2025-37164", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-04T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e43e5d7e-3f98-4df5-aff8-a79553d32660", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-01-15T23:08:52+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-04T00:00:00+00:00", "first_seen_at": "2026-01-15T23:08:52+00:00"}, "scope": {"notes": "Affected: HPE / HPE OneView | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-02-04: 50", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-37164", "url": "https://www.cve.org/CVERecord?id=CVE-2025-37164"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HPE", "30d_avg": 2, "90d_avg": 0, "product": "HPE OneView", "cisa_kev": "yes", "connections": 50, "observation_date": "2026-02-04", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "8a93bfa2-ee1d-4749-9e77-13a560e31de2", "vulnerability": {"vulnId": "CVE-2025-7544", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-29T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8a93bfa2-ee1d-4749-9e77-13a560e31de2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-01-22T01:34:35+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-01-29T00:00:00+00:00", "first_seen_at": "2026-01-22T01:34:35+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda AC1206 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-01-29: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-7544", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7544"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda AC1206", "cisa_kev": "no", "connections": 3, "observation_date": "2026-01-29", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "439f05d5-85b2-4b83-a608-64d4d6bf938b", "vulnerability": {"vulnId": "CVE-2026-24061", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-01-23T16:10:04+00:00"}, "gcve": {"gna": 1, "object_uuid": "439f05d5-85b2-4b83-a608-64d4d6bf938b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-23T16:10:04+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-01-23T16:10:04+00:00", "first_seen_at": "2026-01-23T16:10:04+00:00"}, "scope": {"notes": "Affected: GNU Operating System / GNU Inetutils (telnetd) | Severity: CRITICAL (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-01-23: 115", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2026-24061", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24061"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "brute-force", "class": null, "7d_avg": 0, "vendor": "GNU Operating System", "30d_avg": 0, "90d_avg": 0, "product": "GNU Inetutils (telnetd)", "cisa_kev": "no", "connections": 115, "observation_date": "2026-01-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "CRITICAL"}}]}
{"uuid": "70ab7749-df5c-4809-8085-3c5b4716a503", "vulnerability": {"vulnId": "CVE-2023-7311", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-08T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "70ab7749-df5c-4809-8085-3c5b4716a503", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-24T15:45:40+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-08T00:00:00+00:00", "first_seen_at": "2025-10-24T15:45:40+00:00"}, "scope": {"notes": "Affected: BYTEVALUE / BYTEVALUE Intelligent Flow Control Router | Class: router | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-12-08: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7311", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7311"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "BYTEVALUE", "30d_avg": 0, "90d_avg": 0, "product": "BYTEVALUE Intelligent Flow Control Router", "cisa_kev": "no", "connections": 2, "observation_date": "2025-12-08", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "73d2ce4d-ccfb-46b4-9fbd-0f9e827906d8", "vulnerability": {"vulnId": "CVE-2023-7308", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "73d2ce4d-ccfb-46b4-9fbd-0f9e827906d8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-24T21:01:53+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-06T00:00:00+00:00", "first_seen_at": "2025-10-24T21:01:53+00:00"}, "scope": {"notes": "Affected: NSFOCUS / NSFOCUS SecGate3600 Firewall | Class: firewall | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-12-06: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7308", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7308"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "NSFOCUS", "30d_avg": 0, "90d_avg": 0, "product": "NSFOCUS SecGate3600 Firewall", "cisa_kev": "no", "connections": 1, "observation_date": "2025-12-06", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "0f53b82f-646e-4652-84f8-08f70c16a4e2", "vulnerability": {"vulnId": "CVE-2021-29003", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0f53b82f-646e-4652-84f8-08f70c16a4e2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-11-28T07:55:30+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-05T00:00:00+00:00", "first_seen_at": "2025-11-28T07:55:30+00:00"}, "scope": {"notes": "Affected: Genexis / Genexis PLATINUM 4410 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-12-05: 297", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-29003", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29003"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Genexis", "30d_avg": 0, "90d_avg": 0, "product": "Genexis PLATINUM 4410", "cisa_kev": "no", "connections": 297, "observation_date": "2025-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6c8a63da-e6fa-4e20-a6c2-6f0d8fd04fca", "vulnerability": {"vulnId": "CVE-2025-7414", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6c8a63da-e6fa-4e20-a6c2-6f0d8fd04fca", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-09-23T16:16:59+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-05T00:00:00+00:00", "first_seen_at": "2025-09-23T16:16:59+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda 03V2 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-12-05: 313", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-7414", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7414"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda 03V2", "cisa_kev": "no", "connections": 313, "observation_date": "2025-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "60fb582d-7112-4129-beb1-632030992dc5", "vulnerability": {"vulnId": "CVE-2018-25118", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "60fb582d-7112-4129-beb1-632030992dc5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-24T15:45:40+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-05T00:00:00+00:00", "first_seen_at": "2025-10-24T15:45:40+00:00"}, "scope": {"notes": "Affected: GeoVision / GeoVision embedded devices | Class: video-system | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-12-05: 298", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-25118", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25118"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "GeoVision", "30d_avg": 0, "90d_avg": 0, "product": "GeoVision embedded devices", "cisa_kev": "no", "connections": 298, "observation_date": "2025-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "f90eb412-5310-4934-8956-c109519e793c", "vulnerability": {"vulnId": "CVE-2025-61757", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-12-03T16:55:54+00:00"}, "gcve": {"gna": 1, "object_uuid": "f90eb412-5310-4934-8956-c109519e793c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-12-03T16:55:54+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-12-03T16:55:54+00:00", "first_seen_at": "2025-12-03T16:55:54+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Fusion Middleware (Identity Manager) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-12-03: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-61757", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61757"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle Fusion Middleware (Identity Manager)", "cisa_kev": "yes", "connections": 2, "observation_date": "2025-12-03", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2fc3650d-c0f2-4ca2-8ee5-f589986d2fd8", "vulnerability": {"vulnId": "CVE-2025-45988", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-11-26T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2fc3650d-c0f2-4ca2-8ee5-f589986d2fd8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-09-15T00:59:21+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-11-26T00:00:00+00:00", "first_seen_at": "2025-09-15T00:59:21+00:00"}, "scope": {"notes": "Affected: LB-LINK / LB-LINK routers (multiple)  | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-11-26: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-45988", "url": "https://www.cve.org/CVERecord?id=CVE-2025-45988"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "LB-LINK", "30d_avg": 0, "90d_avg": 0, "product": "LB-LINK routers (multiple) ", "cisa_kev": "no", "connections": 2, "observation_date": "2025-11-26", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "861f0d79-ed63-4016-a360-de73f7fda9c2", "vulnerability": {"vulnId": "CVE-2024-13984", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-11-24T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "861f0d79-ed63-4016-a360-de73f7fda9c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-22T02:54:06+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-11-24T00:00:00+00:00", "first_seen_at": "2025-10-22T02:54:06+00:00"}, "scope": {"notes": "Affected: Qianxin / TianQing Management Center | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-11-24: 26", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-13984", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13984"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Qianxin", "30d_avg": 0, "90d_avg": 0, "product": "TianQing Management Center", "cisa_kev": "no", "connections": 26, "observation_date": "2025-11-24", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "2204a1d7-86e8-444a-b382-0ce4bfb59b2c", "vulnerability": {"vulnId": "CVE-2025-51482", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-11-03T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2204a1d7-86e8-444a-b382-0ce4bfb59b2c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-10-24T22:16:23+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-11-03T00:00:00+00:00", "first_seen_at": "2025-10-24T22:16:23+00:00"}, "scope": {"notes": "Affected: Letta / Letta | Class: ai-system | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-11-03: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-51482", "url": "https://www.cve.org/CVERecord?id=CVE-2025-51482"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "Letta", "30d_avg": 0, "90d_avg": 0, "product": "Letta", "cisa_kev": "no", "connections": 6, "observation_date": "2025-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "f2de76a4-4fbc-47b0-9089-59876dc762d1", "vulnerability": {"vulnId": "CVE-2023-7307", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-10-22T02:56:09+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2de76a4-4fbc-47b0-9089-59876dc762d1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-10-22T02:56:09+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-10-22T02:56:09+00:00", "first_seen_at": "2025-10-22T02:56:09+00:00"}, "scope": {"notes": "Affected: Sangfor / Sangfor Behavior Management System (DC Management System) | Class: security-management-platform | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-10-22: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-7307", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7307"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Sangfor", "30d_avg": 0, "90d_avg": 0, "product": "Sangfor Behavior Management System (DC Management System)", "cisa_kev": "no", "connections": 1, "observation_date": "2025-10-22", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "4ee5ee62-09f6-4f9d-878a-09cf148a4bf8", "vulnerability": {"vulnId": "CVE-2023-27076", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-10-19T14:53:30+00:00"}, "gcve": {"gna": 1, "object_uuid": "4ee5ee62-09f6-4f9d-878a-09cf148a4bf8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-10-19T14:53:30+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2025-10-19T14:53:30+00:00", "first_seen_at": "2025-10-19T14:53:30+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda G103 | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-14: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27076", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27076"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 1, "product": "Tenda G103", "cisa_kev": "no", "connections": 3, "observation_date": "2023-06-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "05e32b7c-d70b-40ca-b0bf-835f7ccab287", "vulnerability": {"vulnId": "CVE-2025-3987", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-10-19T06:38:28+00:00"}, "gcve": {"gna": 1, "object_uuid": "05e32b7c-d70b-40ca-b0bf-835f7ccab287", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-10-19T06:38:28+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-10-19T06:38:28+00:00", "first_seen_at": "2025-10-19T06:38:28+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N150RT | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-10-19: 315", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-3987", "url": "https://www.cve.org/CVERecord?id=CVE-2025-3987"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N150RT", "cisa_kev": "no", "connections": 315, "observation_date": "2025-10-19", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "4593abba-297e-4214-be40-2fbcf3a13db6", "vulnerability": {"vulnId": "CVE-2015-2280", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-10-19T06:17:38+00:00"}, "gcve": {"gna": 1, "object_uuid": "4593abba-297e-4214-be40-2fbcf3a13db6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-10-19T06:17:38+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-10-19T06:17:38+00:00", "first_seen_at": "2025-10-19T06:17:38+00:00"}, "scope": {"notes": "Affected: AirLink101 / AirLink101 SkyIPCam1620W | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-10-19: 253", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-2280", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2280"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "AirLink101", "30d_avg": 0, "90d_avg": 0, "product": "AirLink101 SkyIPCam1620W", "cisa_kev": "no", "connections": 253, "observation_date": "2025-10-19", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "db0dc739-3638-42cb-812d-eac86792c6e4", "vulnerability": {"vulnId": "CVE-2023-47565", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-10-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "db0dc739-3638-42cb-812d-eac86792c6e4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-09-13T05:44:43+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-10-11T00:00:00+00:00", "first_seen_at": "2025-09-13T05:44:43+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP VioStor NVR | Class: video-system | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2025-10-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-47565", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47565"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP VioStor NVR", "cisa_kev": "yes", "connections": 2, "observation_date": "2025-10-11", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "75722e8e-1e0a-4084-a853-d09d694f5a5e", "vulnerability": {"vulnId": "CVE-2024-9593", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "75722e8e-1e0a-4084-a853-d09d694f5a5e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 83}, "timestamps": {"asserted_at": "2025-09-08T13:46:48+00:00", "recorded_at": "2026-06-30T10:03:52+00:00", "last_seen_at": "2025-09-09T00:00:00+00:00", "first_seen_at": "2025-09-08T13:46:48+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Time Clock plugin and Time Clock Pro plugin | Class: cms | Severity: High (CVSS 8.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9593", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9593"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Time Clock plugin and Time Clock Pro plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2025-09-09", "vulnerability_class": "CVSS", "vulnerability_score": 8.3, "vulnerability_severity": "High"}}]}
{"uuid": "aa55d079-581e-4fe2-b68a-3181f0252b64", "vulnerability": {"vulnId": "CVE-2025-54253", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "aa55d079-581e-4fe2-b68a-3181f0252b64", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-08-12T04:09:28+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-02T00:00:00+00:00", "first_seen_at": "2025-08-12T04:09:28+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Experience Manager | Class: cms | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-02: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54253", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54253"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe Experience Manager", "cisa_kev": "no", "connections": 1, "observation_date": "2025-09-02", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "9cee6caf-fe8e-46bf-a5c5-3259aad4174c", "vulnerability": {"vulnId": "CVE-2023-6184", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9cee6caf-fe8e-46bf-a5c5-3259aad4174c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2025-07-18T21:44:42+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-07-18T21:44:42+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix Session Recording | Class: device-management-platform | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-01: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6184", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6184"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 0, "product": "Citrix Session Recording", "cisa_kev": "no", "connections": 7, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "763efdb2-80bd-475f-bad0-e614da82104b", "vulnerability": {"vulnId": "CVE-2021-35232", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "763efdb2-80bd-475f-bad0-e614da82104b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2025-07-29T22:43:03+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-07-29T22:43:03+00:00"}, "scope": {"notes": "Affected: SolarWinds / SolarWinds Web Help Desk | Class: other-software | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-01: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35232", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35232"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "SolarWinds", "30d_avg": 0, "90d_avg": 0, "product": "SolarWinds Web Help Desk", "cisa_kev": "no", "connections": 7, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "4e2315e9-cd00-438f-bf86-78aca9884dfa", "vulnerability": {"vulnId": "CVE-2024-10586", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4e2315e9-cd00-438f-bf86-78aca9884dfa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-18T18:51:20+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-07-18T18:51:20+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Debug Tool plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-01: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-10586", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10586"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Debug Tool plugin", "cisa_kev": "no", "connections": 8, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "11540ea5-319a-4526-8cf6-6044ea29861f", "vulnerability": {"vulnId": "CVE-2020-3259", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "11540ea5-319a-4526-8cf6-6044ea29861f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-12T10:38:33+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-07-12T10:38:33+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ASA and Cisco Firepower Threat Defense | Class: firewall | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-09-01: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-3259", "url": "https://www.cve.org/CVERecord?id=CVE-2020-3259"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 2, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco ASA and Cisco Firepower Threat Defense", "cisa_kev": "yes", "connections": 6, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "b3407849-671e-434c-a9d7-91f6411c69fe", "vulnerability": {"vulnId": "CVE-2025-54254", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b3407849-671e-434c-a9d7-91f6411c69fe", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-08-12T02:17:29+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-08-12T02:17:29+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Experience Manager | Class: cms | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-01: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-54254", "url": "https://www.cve.org/CVERecord?id=CVE-2025-54254"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe Experience Manager", "cisa_kev": "no", "connections": 9, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "14eb6f91-639a-422c-87fc-2b29c47d5724", "vulnerability": {"vulnId": "CVE-2025-49533", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-09-01T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "14eb6f91-639a-422c-87fc-2b29c47d5724", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-30T03:39:08+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-09-01T00:00:00+00:00", "first_seen_at": "2025-07-30T03:39:08+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Experience Manager | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-09-01: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-49533", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49533"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe Experience Manager", "cisa_kev": "no", "connections": 6, "observation_date": "2025-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3ac41da9-577c-4ff6-8c8b-7fb0a9369359", "vulnerability": {"vulnId": "CVE-2024-8957", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-08-22T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3ac41da9-577c-4ff6-8c8b-7fb0a9369359", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-05-29T15:27:07+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-08-22T00:00:00+00:00", "first_seen_at": "2025-05-29T15:27:07+00:00"}, "scope": {"notes": "Affected: PTZOptics / PTZOptics PT30X-SDI/NDI-xx | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2025-08-22: 11", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8957", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8957"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "PTZOptics", "30d_avg": 0, "90d_avg": 0, "product": "PTZOptics PT30X-SDI/NDI-xx", "cisa_kev": "yes", "connections": 11, "observation_date": "2025-08-22", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4654dafa-8444-4c2d-82a0-3c761ea6cdbc", "vulnerability": {"vulnId": "CVE-2022-44149", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-08-19T21:33:27+00:00"}, "gcve": {"gna": 1, "object_uuid": "4654dafa-8444-4c2d-82a0-3c761ea6cdbc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-08-19T21:33:27+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2025-08-19T21:33:27+00:00", "first_seen_at": "2025-08-19T21:33:27+00:00"}, "scope": {"notes": "Affected: Nexxt / Amp300 ARN02304U8 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-01-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-44149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-44149"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Nexxt", "30d_avg": 0, "90d_avg": 0, "product": "Amp300 ARN02304U8", "cisa_kev": "no", "connections": 2, "observation_date": "2023-01-13", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "793dce70-b29e-482c-8235-4f2747df61c0", "vulnerability": {"vulnId": "CVE-2025-48703", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-08-15T15:41:54+00:00"}, "gcve": {"gna": 1, "object_uuid": "793dce70-b29e-482c-8235-4f2747df61c0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-08-15T15:41:54+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-08-15T15:41:54+00:00", "first_seen_at": "2025-08-15T15:41:54+00:00"}, "scope": {"notes": "Affected: CWP / CWP (Control Web Panel) | Class: device-management-platform | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-08-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-48703", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48703"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "CWP", "30d_avg": 0, "90d_avg": 0, "product": "CWP (Control Web Panel)", "cisa_kev": "no", "connections": 2, "observation_date": "2025-08-15", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "415967ad-5f7f-4f66-b46f-a2bac487ab7d", "vulnerability": {"vulnId": "CVE-2025-20281", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-08-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "415967ad-5f7f-4f66-b46f-a2bac487ab7d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T23:26:39+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-08-13T00:00:00+00:00", "first_seen_at": "2025-07-13T23:26:39+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco ISE and ISE-PIC | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-08-13: 78", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-20281", "url": "https://www.cve.org/CVERecord?id=CVE-2025-20281"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco ISE and ISE-PIC", "cisa_kev": "yes", "connections": 78, "observation_date": "2025-08-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "vulnerability": {"vulnId": "CVE-2025-48827", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-31T11:19:50+00:00"}, "gcve": {"gna": 1, "object_uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2025-07-31T11:19:50+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-31T11:19:50+00:00", "first_seen_at": "2025-07-31T11:19:50+00:00"}, "scope": {"notes": "Affected: vBulletin / vBulletin | Class: cms | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-31: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-48827", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48827"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "vBulletin", "30d_avg": 0, "90d_avg": 0, "product": "vBulletin", "cisa_kev": "no", "connections": 2, "observation_date": "2025-07-31", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}]}
{"uuid": "f3dd3369-2790-4b4d-ae51-7347041acfcf", "vulnerability": {"vulnId": "CVE-2025-6543", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-30T08:58:45+00:00"}, "gcve": {"gna": 1, "object_uuid": "f3dd3369-2790-4b4d-ae51-7347041acfcf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2025-07-30T08:58:45+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-30T08:58:45+00:00", "first_seen_at": "2025-07-30T08:58:45+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler ADC and NetScaler Gateway | Class: app-delivery-controller | Severity: None (CVSS 0) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-07-30: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-6543", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6543"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 0, "product": "Citrix NetScaler ADC and NetScaler Gateway", "cisa_kev": "yes", "connections": 14, "observation_date": "2025-07-30", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "36f6e52e-e38c-4ba4-afd1-4113be61be09", "vulnerability": {"vulnId": "CVE-2023-6549", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-29T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "36f6e52e-e38c-4ba4-afd1-4113be61be09", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-02T10:20:50+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-29T00:00:00+00:00", "first_seen_at": "2025-07-02T10:20:50+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler ADC and NetScaler Gateway | Class: app-delivery-controller | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-07-29: 289", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6549", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6549"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 1, "90d_avg": 0, "product": "Citrix NetScaler ADC and NetScaler Gateway", "cisa_kev": "yes", "connections": 289, "observation_date": "2025-07-29", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a0254941-ce81-43af-b603-ed0f65c50b5a", "vulnerability": {"vulnId": "CVE-2024-34193", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T02:02:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "a0254941-ce81-43af-b603-ed0f65c50b5a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-21T02:02:47+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T02:02:47+00:00", "first_seen_at": "2025-07-21T02:02:47+00:00"}, "scope": {"notes": "Affected: kw199711 / smanga | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 36", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-34193", "url": "https://www.cve.org/CVERecord?id=CVE-2024-34193"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "kw199711", "30d_avg": 0, "90d_avg": 0, "product": "smanga", "cisa_kev": "no", "connections": 36, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "b4f7574b-1c50-4472-bb74-c3bb07a91ee4", "vulnerability": {"vulnId": "CVE-2025-28137", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "b4f7574b-1c50-4472-bb74-c3bb07a91ee4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:58:14+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:14+00:00", "first_seen_at": "2025-07-21T01:58:14+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A810R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 38", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-28137", "url": "https://www.cve.org/CVERecord?id=CVE-2025-28137"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A810R", "cisa_kev": "no", "connections": 38, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d8d7ebd7-31f6-4f01-bc79-c51a471288b6", "vulnerability": {"vulnId": "CVE-2023-5285", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "d8d7ebd7-31f6-4f01-bc79-c51a471288b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-21T01:58:14+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:14+00:00", "first_seen_at": "2025-07-21T01:58:14+00:00"}, "scope": {"notes": "Affected: Tongda / Tongda OA | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 55", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5285", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5285"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Tongda", "30d_avg": 0, "90d_avg": 0, "product": "Tongda OA", "cisa_kev": "no", "connections": 55, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c2dfee1f-d380-44d8-821f-adea4cae60eb", "vulnerability": {"vulnId": "CVE-2022-28908", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "c2dfee1f-d380-44d8-821f-adea4cae60eb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:58:14+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:14+00:00", "first_seen_at": "2025-07-21T01:58:14+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N600R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 40", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28908", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28908"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N600R", "cisa_kev": "no", "connections": 40, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "396b7abe-62ac-4589-b9ce-5ba08a64980e", "vulnerability": {"vulnId": "CVE-2018-13350", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:12+00:00"}, "gcve": {"gna": 1, "object_uuid": "396b7abe-62ac-4589-b9ce-5ba08a64980e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:58:12+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:12+00:00", "first_seen_at": "2025-07-21T01:58:12+00:00"}, "scope": {"notes": "Affected: Terramaster / TOS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 43", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-13350", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13350"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Terramaster", "30d_avg": 0, "90d_avg": 0, "product": "TOS", "cisa_kev": "no", "connections": 43, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f8e33311-33c1-485f-878d-0d8b82298b0c", "vulnerability": {"vulnId": "CVE-2025-4281", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:09+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8e33311-33c1-485f-878d-0d8b82298b0c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 43}, "timestamps": {"asserted_at": "2025-07-21T01:58:09+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:09+00:00", "first_seen_at": "2025-07-21T01:58:09+00:00"}, "scope": {"notes": "Affected: Shenzhen Sixun Software / Sixun Shanghui 7 Group Business Management System 7 | Class: other-software | Severity: Medium (CVSS 4.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 40", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-4281", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4281"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Shenzhen Sixun Software", "30d_avg": 0, "90d_avg": 0, "product": "Sixun Shanghui 7 Group Business Management System 7", "cisa_kev": "no", "connections": 40, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 4.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "5b9267b8-230f-4bce-82a5-fe7aa6df334d", "vulnerability": {"vulnId": "CVE-2023-30194", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:58:05+00:00"}, "gcve": {"gna": 1, "object_uuid": "5b9267b8-230f-4bce-82a5-fe7aa6df334d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:58:05+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:58:05+00:00", "first_seen_at": "2025-07-21T01:58:05+00:00"}, "scope": {"notes": "Affected: PrestaShop / Posthemes - Static Footer module for PrestaShop | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 55", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-30194", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30194"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "PrestaShop", "30d_avg": 0, "90d_avg": 0, "product": "Posthemes - Static Footer module for PrestaShop", "cisa_kev": "no", "connections": 55, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "87a1f10f-48e0-4167-8020-c8ffad4c99a0", "vulnerability": {"vulnId": "CVE-2019-3495", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:57:27+00:00"}, "gcve": {"gna": 1, "object_uuid": "87a1f10f-48e0-4167-8020-c8ffad4c99a0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:57:27+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:57:27+00:00", "first_seen_at": "2025-07-21T01:57:27+00:00"}, "scope": {"notes": "Affected: Wifi-soft / Wifi-soft Unibox | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 41", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-3495", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3495"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Wifi-soft", "30d_avg": 0, "90d_avg": 0, "product": "Wifi-soft Unibox", "cisa_kev": "no", "connections": 41, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5e15dcbb-81d1-4479-a2ab-0a1c428cce93", "vulnerability": {"vulnId": "CVE-2023-5683", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T01:56:50+00:00"}, "gcve": {"gna": 1, "object_uuid": "5e15dcbb-81d1-4479-a2ab-0a1c428cce93", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-21T01:56:50+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T01:56:50+00:00", "first_seen_at": "2025-07-21T01:56:50+00:00"}, "scope": {"notes": "Affected: Byzoro / Byzoro Smart S85F Management Platform | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-21: 56", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-5683", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5683"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Byzoro", "30d_avg": 0, "90d_avg": 0, "product": "Byzoro Smart S85F Management Platform", "cisa_kev": "no", "connections": 56, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2cbb5d0b-d547-43d4-99f5-ad02174dc6e8", "vulnerability": {"vulnId": "CVE-2024-0297", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2cbb5d0b-d547-43d4-99f5-ad02174dc6e8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:16:05+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:16:05+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N200RE | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 49", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0297", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0297"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N200RE", "cisa_kev": "no", "connections": 49, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "94e3ab1d-369a-4e48-8f12-2801eac2340d", "vulnerability": {"vulnId": "CVE-2025-28036", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "94e3ab1d-369a-4e48-8f12-2801eac2340d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:16:06+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:16:06+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A950RG  | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 37", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-28036", "url": "https://www.cve.org/CVERecord?id=CVE-2025-28036"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A950RG ", "cisa_kev": "no", "connections": 37, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b6b9e27a-cfe4-4b8d-86fa-72b81a4e92c8", "vulnerability": {"vulnId": "CVE-2022-28907", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b6b9e27a-cfe4-4b8d-86fa-72b81a4e92c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:16:05+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:16:05+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N600R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 38", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28907", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28907"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N600R", "cisa_kev": "no", "connections": 38, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fa5be590-533e-4b7b-af9a-250a33da052c", "vulnerability": {"vulnId": "CVE-2022-28906", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fa5be590-533e-4b7b-af9a-250a33da052c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:12:48+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:12:48+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N600R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 36", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28906", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28906"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N600R", "cisa_kev": "no", "connections": 36, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "97776397-ab75-4019-be84-4b12280a86c9", "vulnerability": {"vulnId": "CVE-2023-23063", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "97776397-ab75-4019-be84-4b12280a86c9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-06-08T20:16:33+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-06-08T20:16:33+00:00"}, "scope": {"notes": "Affected: Cellinx / Cellinx NVT Camera | Class: video-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-23063", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23063"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Cellinx", "30d_avg": 0, "90d_avg": 0, "product": "Cellinx NVT Camera", "cisa_kev": "no", "connections": 51, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a6bfc331-03c4-4851-95ce-4fb7aea0ddd2", "vulnerability": {"vulnId": "CVE-2024-9001", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a6bfc331-03c4-4851-95ce-4fb7aea0ddd2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-07-13T16:16:07+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:16:07+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink T10 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 42", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9001", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9001"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink T10", "cisa_kev": "no", "connections": 42, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "2d0b2cbc-e9ea-4026-b43c-40723c3c1f4b", "vulnerability": {"vulnId": "CVE-2024-0292", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "2d0b2cbc-e9ea-4026-b43c-40723c3c1f4b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-07-13T16:16:10+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-21T00:00:00+00:00", "first_seen_at": "2025-07-13T16:16:10+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink LR1200GB | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-21: 36", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0292", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0292"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink LR1200GB", "cisa_kev": "no", "connections": 36, "observation_date": "2025-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "vulnerability": {"vulnId": "CVE-2020-27387", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-13T11:29:35+00:00"}, "gcve": {"gna": 1, "object_uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-07-13T11:29:35+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-13T11:29:35+00:00", "first_seen_at": "2025-07-13T11:29:35+00:00"}, "scope": {"notes": "Affected: ttimot24 / HorizontCMS | Class: cms | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-07-13: 24", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-27387", "url": "https://www.cve.org/CVERecord?id=CVE-2020-27387"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ttimot24", "30d_avg": 0, "90d_avg": 0, "product": "HorizontCMS", "cisa_kev": "no", "connections": 24, "observation_date": "2025-07-13", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "9569766c-3c4b-4a03-bb2d-9f7afc8778f4", "vulnerability": {"vulnId": "CVE-2024-7399", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9569766c-3c4b-4a03-bb2d-9f7afc8778f4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-06-16T17:33:00+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-10T00:00:00+00:00", "first_seen_at": "2025-06-16T17:33:00+00:00"}, "scope": {"notes": "Affected: Samsung / Samsung magicINFO 9 | Class: cms | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-10: 68", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-7399", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7399"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Samsung", "30d_avg": 0, "90d_avg": 0, "product": "Samsung magicINFO 9", "cisa_kev": "no", "connections": 68, "observation_date": "2025-07-10", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "0e5c26b3-104b-448b-a3e2-5fecabc38de8", "vulnerability": {"vulnId": "CVE-2014-1677", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-07-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e5c26b3-104b-448b-a3e2-5fecabc38de8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-07-02T15:59:29+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-07-06T00:00:00+00:00", "first_seen_at": "2025-07-02T15:59:29+00:00"}, "scope": {"notes": "Affected: Technicolor / Technicolor TC7200 | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-07-06: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-1677", "url": "https://www.cve.org/CVERecord?id=CVE-2014-1677"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Technicolor", "30d_avg": 0, "90d_avg": 0, "product": "Technicolor TC7200", "cisa_kev": "no", "connections": 6, "observation_date": "2025-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "3a74f112-5d20-4493-abef-e11cf8dce718", "vulnerability": {"vulnId": "CVE-2021-27692", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-06-08T17:39:56+00:00"}, "gcve": {"gna": 1, "object_uuid": "3a74f112-5d20-4493-abef-e11cf8dce718", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-06-08T17:39:56+00:00", "recorded_at": "2026-06-30T11:20:47+00:00", "last_seen_at": "2025-06-08T17:39:56+00:00", "first_seen_at": "2025-06-08T17:39:56+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda G1 and G3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-06-08: 13", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-27692", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27692"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda G1 and G3", "cisa_kev": "no", "connections": 13, "observation_date": "2025-06-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ddfb93ef-1945-4a74-a295-80376ddf3802", "vulnerability": {"vulnId": "CVE-2024-50623", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-05-25T18:56:57+00:00"}, "gcve": {"gna": 1, "object_uuid": "ddfb93ef-1945-4a74-a295-80376ddf3802", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-05-25T18:56:57+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-05-25T18:56:57+00:00", "first_seen_at": "2025-05-25T18:56:57+00:00"}, "scope": {"notes": "Affected: Cleo / Cleo Harmony, VLTrader and LexiCom | Class: file-transfer | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-05-25: 252", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-50623", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50623"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "Cleo", "30d_avg": 0, "90d_avg": 0, "product": "Cleo Harmony, VLTrader and LexiCom", "cisa_kev": "yes", "connections": 252, "observation_date": "2025-05-25", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "bfd342dc-fed7-4b8a-a369-9f1d4a552e69", "vulnerability": {"vulnId": "CVE-2023-51833", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-05-20T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bfd342dc-fed7-4b8a-a369-9f1d4a552e69", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2025-05-04T08:17:09+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-05-20T00:00:00+00:00", "first_seen_at": "2025-05-04T08:17:09+00:00"}, "scope": {"notes": "Affected: TRENDnet / TRENDnet TEW-411BRPplus | Class: router | Severity: High (CVSS 8.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-05-20: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-51833", "url": "https://www.cve.org/CVERecord?id=CVE-2023-51833"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "TRENDnet", "30d_avg": 0, "90d_avg": 0, "product": "TRENDnet TEW-411BRPplus", "cisa_kev": "no", "connections": 1, "observation_date": "2025-05-20", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "00b0a1f0-f118-401f-b743-6f6da661c780", "vulnerability": {"vulnId": "CVE-2025-24016", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-05-16T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "00b0a1f0-f118-401f-b743-6f6da661c780", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 99}, "timestamps": {"asserted_at": "2025-05-03T23:52:16+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-05-16T00:00:00+00:00", "first_seen_at": "2025-05-03T23:52:16+00:00"}, "scope": {"notes": "Affected: Wazuh / Wazuh | Class: security-management-platform | Severity: Critical (CVSS 9.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-05-16: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-24016", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24016"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "Wazuh", "30d_avg": 0, "90d_avg": 0, "product": "Wazuh", "cisa_kev": "no", "connections": 3, "observation_date": "2025-05-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.9, "vulnerability_severity": "Critical"}}]}
{"uuid": "b50b68bb-b488-4ccb-9adf-9e5021e4b076", "vulnerability": {"vulnId": "CVE-2022-28912", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-04-19T05:04:08+00:00"}, "gcve": {"gna": 1, "object_uuid": "b50b68bb-b488-4ccb-9adf-9e5021e4b076", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-04-19T05:04:08+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-04-19T05:04:08+00:00", "first_seen_at": "2025-04-19T05:04:08+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N600R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-04-19: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-28912", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28912"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N600R", "cisa_kev": "no", "connections": 1, "observation_date": "2025-04-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "11af19e4-0ab0-4b81-a716-7657fc1b193f", "vulnerability": {"vulnId": "CVE-2024-11120", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-04-07T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "11af19e4-0ab0-4b81-a716-7657fc1b193f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-04-06T15:32:57+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-04-07T00:00:00+00:00", "first_seen_at": "2025-04-06T15:32:57+00:00"}, "scope": {"notes": "Affected: GeoVision / GeoVision multiple EOL products | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-04-07: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-11120", "url": "https://www.cve.org/CVERecord?id=CVE-2024-11120"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "GeoVision", "30d_avg": 0, "90d_avg": 0, "product": "GeoVision multiple EOL products", "cisa_kev": "no", "connections": 10, "observation_date": "2025-04-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "861b8e4b-7902-4989-af40-a60a9f2886a6", "vulnerability": {"vulnId": "CVE-2025-1316", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-03-23T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "861b8e4b-7902-4989-af40-a60a9f2886a6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-22T19:29:00+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-03-23T00:00:00+00:00", "first_seen_at": "2025-03-22T19:29:00+00:00"}, "scope": {"notes": "Affected: Edimax / Edimax IC-7100 | Class: voip | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2025-03-23: 64", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2025-1316", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1316"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Edimax", "30d_avg": 0, "90d_avg": 0, "product": "Edimax IC-7100", "cisa_kev": "yes", "connections": 64, "observation_date": "2025-03-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "5757d14e-556b-4263-bd50-84cc2929bc7f", "vulnerability": {"vulnId": "CVE-2024-12209", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-03-17T01:09:40+00:00"}, "gcve": {"gna": 1, "object_uuid": "5757d14e-556b-4263-bd50-84cc2929bc7f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-03-17T01:09:40+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-03-17T01:09:40+00:00", "first_seen_at": "2025-03-17T01:09:40+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Update Backup Restore & Monitoring plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-03-17: 15", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-12209", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12209"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Update Backup Restore & Monitoring plugin", "cisa_kev": "no", "connections": 15, "observation_date": "2025-03-17", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "80086eac-82ce-4c24-b601-1bf7d55e3dc8", "vulnerability": {"vulnId": "CVE-2017-17562", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-03-12T08:57:35+00:00"}, "gcve": {"gna": 1, "object_uuid": "80086eac-82ce-4c24-b601-1bf7d55e3dc8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2025-03-12T08:57:35+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-03-12T08:57:35+00:00", "first_seen_at": "2025-03-12T08:57:35+00:00"}, "scope": {"notes": "Affected: Embedthis / GoAhead | Class: embedded-system | Severity: High (CVSS 8.1) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2025-03-12: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-17562", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17562"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Embedthis", "30d_avg": 0, "90d_avg": 0, "product": "GoAhead", "cisa_kev": "yes", "connections": 12, "observation_date": "2025-03-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}]}
{"uuid": "90b87594-ef76-4030-843a-6346730998ab", "vulnerability": {"vulnId": "CVE-2022-41800", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-03-04T03:19:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "90b87594-ef76-4030-843a-6346730998ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2025-03-04T03:19:47+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-03-04T03:19:47+00:00", "first_seen_at": "2025-03-04T03:19:47+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Class: app-delivery-controller | Severity: High (CVSS 8.7) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-03-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-41800", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41800"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "F5", "30d_avg": 0, "90d_avg": 0, "product": "BIG-IP", "cisa_kev": "no", "connections": 1, "observation_date": "2025-03-04", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}]}
{"uuid": "97d0a3de-eea8-4ff3-ac65-6405a47284a7", "vulnerability": {"vulnId": "CVE-2024-9916", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-18T01:47:48+00:00"}, "gcve": {"gna": 1, "object_uuid": "97d0a3de-eea8-4ff3-ac65-6405a47284a7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-18T01:47:48+00:00", "recorded_at": "2026-06-30T11:40:34+00:00", "last_seen_at": "2025-02-18T01:47:48+00:00", "first_seen_at": "2025-02-18T01:47:48+00:00"}, "scope": {"notes": "Affected: HuangDou / HuangDou UTCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2025-02-18: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9916", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9916"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "HuangDou", "30d_avg": 0, "90d_avg": 0, "product": "HuangDou UTCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2025-02-18", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "189c1ba1-b50c-4344-adec-e4a6dad3601f", "vulnerability": {"vulnId": "CVE-2024-2353", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "189c1ba1-b50c-4344-adec-e4a6dad3601f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2025-02-12T06:03:47+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-02-12T06:03:47+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink X6000R | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-14: 21", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-2353", "url": "https://www.cve.org/CVERecord?id=CVE-2024-2353"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink X6000R", "cisa_kev": "no", "connections": 21, "observation_date": "2025-02-14", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "3d23223c-125b-41b8-a1fe-e86b9fcbbcc6", "vulnerability": {"vulnId": "EDB-52028", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3d23223c-125b-41b8-a1fe-e86b9fcbbcc6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2025-01-03T21:41:59+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-01-03T21:41:59+00:00"}, "scope": {"notes": "Affected: Aquatronica / Aquatronica Control System | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2025-02-14: 3368", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-52028", "url": "https://www.exploit-db.com/exploits/52028"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Aquatronica", "30d_avg": 0, "90d_avg": 0, "product": "Aquatronica Control System", "cisa_kev": "no", "connections": 3368, "observation_date": "2025-02-14", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6b1e90c8-3a88-4832-b475-c180175f0846", "vulnerability": {"vulnId": "CNVD-2024-38747", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b1e90c8-3a88-4832-b475-c180175f0846", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2025-01-13T05:21:33+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-01-13T05:21:33+00:00"}, "scope": {"notes": "Affected: Dahua / Dahua Intelligent Cloud Gateway Registration Management Platform | Class: device-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2025-02-14: 18", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Dahua", "30d_avg": 0, "90d_avg": 0, "product": "Dahua Intelligent Cloud Gateway Registration Management Platform", "cisa_kev": "no", "connections": 18, "observation_date": "2025-02-14", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "c34b9040-1f8e-40f9-8687-e5a29e8eacea", "vulnerability": {"vulnId": "CVE-2024-24328", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "c34b9040-1f8e-40f9-8687-e5a29e8eacea", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-12T06:02:41+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-02-12T06:02:41+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A3300R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-14: 21", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-24328", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24328"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A3300R", "cisa_kev": "no", "connections": 21, "observation_date": "2025-02-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "78d844e0-444d-465e-b89c-821b3e187523", "vulnerability": {"vulnId": "CVE-2024-9644", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "78d844e0-444d-465e-b89c-821b3e187523", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-09T12:02:46+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-02-09T12:02:46+00:00"}, "scope": {"notes": "Affected: Four-Faith / Four-Faith F3x36 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-14: 53", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-9644", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9644"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Four-Faith", "30d_avg": 0, "90d_avg": 0, "product": "Four-Faith F3x36", "cisa_kev": "no", "connections": 53, "observation_date": "2025-02-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a791c219-cd6b-4c9c-8bcd-d42469855607", "vulnerability": {"vulnId": "CVE-2024-24329", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a791c219-cd6b-4c9c-8bcd-d42469855607", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-12T06:02:40+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-02-12T06:02:40+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A3300R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-14: 20", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-24329", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24329"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A3300R", "cisa_kev": "no", "connections": 20, "observation_date": "2025-02-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f9a81ae8-d54b-45bd-8367-435db8fa020f", "vulnerability": {"vulnId": "CVE-2024-57727", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f9a81ae8-d54b-45bd-8367-435db8fa020f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2025-02-04T18:48:38+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-14T00:00:00+00:00", "first_seen_at": "2025-02-04T18:48:38+00:00"}, "scope": {"notes": "Affected: SimpleHelp / SimpleHelp | Class: remote-access | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-02-14: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-57727", "url": "https://www.cve.org/CVERecord?id=CVE-2024-57727"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 1, "vendor": "SimpleHelp", "30d_avg": 0, "90d_avg": 0, "product": "SimpleHelp", "cisa_kev": "yes", "connections": 10, "observation_date": "2025-02-14", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "edcd5110-5851-40b7-b621-2f96b2e72b80", "vulnerability": {"vulnId": "CVE-2021-43163", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "edcd5110-5851-40b7-b621-2f96b2e72b80", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T09:01:54+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-13T00:00:00+00:00", "first_seen_at": "2024-12-05T09:01:54+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / Ruijie RG-EW Series Routers | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-43163", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43163"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "Ruijie RG-EW Series Routers", "cisa_kev": "no", "connections": 2, "observation_date": "2025-02-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "55c34843-28f7-4779-a77d-a9adcede513b", "vulnerability": {"vulnId": "CVE-2024-12987", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-12T06:57:22+00:00"}, "gcve": {"gna": 1, "object_uuid": "55c34843-28f7-4779-a77d-a9adcede513b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2025-02-12T06:57:22+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-12T06:57:22+00:00", "first_seen_at": "2025-02-12T06:57:22+00:00"}, "scope": {"notes": "Affected: Draytek / Draytek Vigor2960 and Vigor300B | Class: router | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-12: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-12987", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12987"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Draytek", "30d_avg": 0, "90d_avg": 0, "product": "Draytek Vigor2960 and Vigor300B", "cisa_kev": "no", "connections": 1, "observation_date": "2025-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}]}
{"uuid": "9e2fa1c3-6368-4a33-a7ba-13340e1548d4", "vulnerability": {"vulnId": "CVE-2024-12856", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-08T15:28:57+00:00"}, "gcve": {"gna": 1, "object_uuid": "9e2fa1c3-6368-4a33-a7ba-13340e1548d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2025-02-08T15:28:57+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-08T15:28:57+00:00", "first_seen_at": "2025-02-08T15:28:57+00:00"}, "scope": {"notes": "Affected: Four-Faith / Four-Faith F3x24 and F3x36 | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-08: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-12856", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12856"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Four-Faith", "30d_avg": 0, "90d_avg": 0, "product": "Four-Faith F3x24 and F3x36", "cisa_kev": "no", "connections": 4, "observation_date": "2025-02-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "42957f41-3114-43e3-a073-04f05efa27c0", "vulnerability": {"vulnId": "CVE-2024-6298", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-02-02T04:52:36+00:00"}, "gcve": {"gna": 1, "object_uuid": "42957f41-3114-43e3-a073-04f05efa27c0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-02-02T04:52:36+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-02-02T04:52:36+00:00", "first_seen_at": "2025-02-02T04:52:36+00:00"}, "scope": {"notes": "Affected: ABB / ABB ASPECT-Enterprise on Linux, ABB NEXUS Series on Linux, ABB MATRIX Series on Linux | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2025-02-02: 9", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-6298", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6298"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ABB", "30d_avg": 0, "90d_avg": 0, "product": "ABB ASPECT-Enterprise on Linux, ABB NEXUS Series on Linux, ABB MATRIX Series on Linux", "cisa_kev": "no", "connections": 9, "observation_date": "2025-02-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6ccdc41a-de53-4375-9535-56bfec0454b6", "vulnerability": {"vulnId": "CVE-2023-27992", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-23T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6ccdc41a-de53-4375-9535-56bfec0454b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2025-01-07T16:10:20+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-01-23T00:00:00+00:00", "first_seen_at": "2025-01-07T16:10:20+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NAS326/NAS540/NAS542 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2025-01-23: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27992", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27992"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Zyxel NAS326/NAS540/NAS542", "cisa_kev": "yes", "connections": 5, "observation_date": "2025-01-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ff049344-0749-432f-8577-4cd46e7a7f32", "vulnerability": {"vulnId": "CVE-2023-28461", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2025-01-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff049344-0749-432f-8577-4cd46e7a7f32", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-03T08:52:05+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2025-01-14T00:00:00+00:00", "first_seen_at": "2024-12-03T08:52:05+00:00"}, "scope": {"notes": "Affected: Array Networks / Array AG Series and vxAG | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2025-01-14: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-28461", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28461"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Array Networks", "30d_avg": 0, "90d_avg": 0, "product": "Array AG Series and vxAG", "cisa_kev": "yes", "connections": 1, "observation_date": "2025-01-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f7cb44ce-4105-4536-923a-f9b9a48a1539", "vulnerability": {"vulnId": "CVE-2024-8069", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-26T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f7cb44ce-4105-4536-923a-f9b9a48a1539", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-11-13T04:53:43+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-26T00:00:00+00:00", "first_seen_at": "2024-11-13T04:53:43+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix Virtual Apps and Desktops | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-12-26: 19", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-8069", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8069"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 0, "90d_avg": 0, "product": "Citrix Virtual Apps and Desktops", "cisa_kev": "no", "connections": 19, "observation_date": "2024-12-26", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "67456047-a2cd-4d55-96b3-ad654562e838", "vulnerability": {"vulnId": "CVE-2024-53677", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-20T08:19:33+00:00"}, "gcve": {"gna": 1, "object_uuid": "67456047-a2cd-4d55-96b3-ad654562e838", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-12-20T08:19:33+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-20T08:19:33+00:00", "first_seen_at": "2024-12-20T08:19:33+00:00"}, "scope": {"notes": "Affected: Apache / Struts | Class: web-app-framework | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-12-20: 2277", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-53677", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53677"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Struts", "cisa_kev": "no", "connections": 2277, "observation_date": "2024-12-20", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "37c0d273-023d-4764-92e2-b7dfef370cc6", "vulnerability": {"vulnId": "CVE-2021-42912", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-20T04:21:10+00:00"}, "gcve": {"gna": 1, "object_uuid": "37c0d273-023d-4764-92e2-b7dfef370cc6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-12-20T04:21:10+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-20T04:21:10+00:00", "first_seen_at": "2024-12-20T04:21:10+00:00"}, "scope": {"notes": "Affected: FiberHome / FiberHome ONU GPON AN550 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-12-20: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-42912", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42912"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "FiberHome", "30d_avg": 0, "90d_avg": 0, "product": "FiberHome ONU GPON AN550", "cisa_kev": "no", "connections": 8, "observation_date": "2024-12-20", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "30da7c9e-c8cf-4e8a-a585-57d6314f7bc6", "vulnerability": {"vulnId": "CVE-2022-36559", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-05T09:02:58+00:00"}, "gcve": {"gna": 1, "object_uuid": "30da7c9e-c8cf-4e8a-a585-57d6314f7bc6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T09:02:58+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-05T09:02:58+00:00", "first_seen_at": "2024-12-05T09:02:58+00:00"}, "scope": {"notes": "Affected: Seiko / Seiko Skybridge MB-A200 series | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-12-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36559", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36559"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Seiko", "30d_avg": 0, "90d_avg": 0, "product": "Seiko Skybridge MB-A200 series", "cisa_kev": "no", "connections": 1, "observation_date": "2024-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d6ef0726-46d3-465b-9c7a-856ac7e23e25", "vulnerability": {"vulnId": "CVE-2024-51211", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-05T09:01:17+00:00"}, "gcve": {"gna": 1, "object_uuid": "d6ef0726-46d3-465b-9c7a-856ac7e23e25", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-12-05T09:01:17+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-05T09:01:17+00:00", "first_seen_at": "2024-12-05T09:01:17+00:00"}, "scope": {"notes": "Affected: OS4ED / openSIS-Classic Version | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-12-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-51211", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51211"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "OS4ED", "30d_avg": 0, "90d_avg": 0, "product": "openSIS-Classic Version", "cisa_kev": "no", "connections": 1, "observation_date": "2024-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "622f1d01-ef81-4431-addf-4b6952530fcf", "vulnerability": {"vulnId": "CVE-2022-23900", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-05T09:01:01+00:00"}, "gcve": {"gna": 1, "object_uuid": "622f1d01-ef81-4431-addf-4b6952530fcf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T09:01:01+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-05T09:01:01+00:00", "first_seen_at": "2024-12-05T09:01:01+00:00"}, "scope": {"notes": "Affected: WAVLINK / WAVLINK WL-WN531P3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-12-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-23900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23900"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "WAVLINK", "30d_avg": 0, "90d_avg": 0, "product": "WAVLINK WL-WN531P3", "cisa_kev": "no", "connections": 1, "observation_date": "2024-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "29b769b9-3e83-45cd-9da1-f879e509ee22", "vulnerability": {"vulnId": "CVE-2024-34854", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-12-05T08:59:57+00:00"}, "gcve": {"gna": 1, "object_uuid": "29b769b9-3e83-45cd-9da1-f879e509ee22", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-12-05T08:59:57+00:00", "recorded_at": "2026-06-30T11:55:10+00:00", "last_seen_at": "2024-12-05T08:59:57+00:00", "first_seen_at": "2024-12-05T08:59:57+00:00"}, "scope": {"notes": "Affected: F-Logic / DataCube3 | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-12-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-34854", "url": "https://www.cve.org/CVERecord?id=CVE-2024-34854"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "F-Logic", "30d_avg": 0, "90d_avg": 0, "product": "DataCube3", "cisa_kev": "no", "connections": 1, "observation_date": "2024-12-05", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3dcb71d2-2ffb-4312-8621-42166b37d5b0", "vulnerability": {"vulnId": "CNVD-2021-64035", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-11-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3dcb71d2-2ffb-4312-8621-42166b37d5b0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-08-06T15:06:44+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-11-06T00:00:00+00:00", "first_seen_at": "2024-08-06T15:06:44+00:00"}, "scope": {"notes": "Affected: Beijing NetGuard Nebula Information Technology / Leadsec VPN | Class: vpn | IoT: no | In CISA KEV: no | Honeypot connections on 2024-11-06: 33", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "vpn", "7d_avg": 3, "vendor": "Beijing NetGuard Nebula Information Technology", "30d_avg": 1, "90d_avg": 1, "product": "Leadsec VPN", "cisa_kev": "no", "connections": 33, "observation_date": "2024-11-06", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "9e90fb3e-1886-4390-a6eb-b6c717104791", "vulnerability": {"vulnId": "CNVD-2021-45363", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-11-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9e90fb3e-1886-4390-a6eb-b6c717104791", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-09-29T18:08:43+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-11-05T00:00:00+00:00", "first_seen_at": "2024-09-29T18:08:43+00:00"}, "scope": {"notes": "Affected: Shenzhen Lingkong Technology / WIFISKY 7-layer flow control router | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2024-11-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Lingkong Technology", "30d_avg": 0, "90d_avg": 0, "product": "WIFISKY 7-layer flow control router", "cisa_kev": "no", "connections": 1, "observation_date": "2024-11-05", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "0a7b1d96-0a2b-4145-9bf3-de25329f3748", "vulnerability": {"vulnId": "EDB-43907", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-11-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0a7b1d96-0a2b-4145-9bf3-de25329f3748", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-07-30T11:05:53+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-11-05T00:00:00+00:00", "first_seen_at": "2024-07-30T11:05:53+00:00"}, "scope": {"notes": "Affected: RainbowFish Software / PacsOne Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2024-11-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-43907", "url": "https://www.exploit-db.com/exploits/43907"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "RainbowFish Software", "30d_avg": 0, "90d_avg": 0, "product": "PacsOne Server", "cisa_kev": "no", "connections": 1, "observation_date": "2024-11-05", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "fa7b62d4-a738-459c-9928-612338a27766", "vulnerability": {"vulnId": "CVE-2022-26186", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-11-03T07:56:30+00:00"}, "gcve": {"gna": 1, "object_uuid": "fa7b62d4-a738-459c-9928-612338a27766", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-11-03T07:56:30+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-11-03T07:56:30+00:00", "first_seen_at": "2024-11-03T07:56:30+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink N600R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-11-03: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-26186", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26186"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink N600R", "cisa_kev": "no", "connections": 1, "observation_date": "2024-11-03", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "45177c4f-cf5e-4fc1-b4ee-1619d65b4539", "vulnerability": {"vulnId": "CVE-2024-34102", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-11-01T14:58:05+00:00"}, "gcve": {"gna": 1, "object_uuid": "45177c4f-cf5e-4fc1-b4ee-1619d65b4539", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-11-01T14:58:05+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-11-01T14:58:05+00:00", "first_seen_at": "2024-11-01T14:58:05+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Commerce and Magento Open Source | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-11-01: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-34102", "url": "https://www.cve.org/CVERecord?id=CVE-2024-34102"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe Commerce and Magento Open Source", "cisa_kev": "yes", "connections": 4, "observation_date": "2024-11-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "3d6914a1-e9ac-47c9-a570-0cee0b47bb15", "vulnerability": {"vulnId": "CVE-2021-30461", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-29T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "3d6914a1-e9ac-47c9-a570-0cee0b47bb15", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-06T17:06:51+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-29T00:00:00+00:00", "first_seen_at": "2024-09-06T17:06:51+00:00"}, "scope": {"notes": "Affected: VoIPmonitor / VoIPmonitor | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-10-29: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-30461", "url": "https://www.cve.org/CVERecord?id=CVE-2021-30461"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "VoIPmonitor", "30d_avg": 0, "90d_avg": 0, "product": "VoIPmonitor", "cisa_kev": "no", "connections": 2, "observation_date": "2024-10-29", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e21c51a4-c763-4cfa-b829-93bd06110368", "vulnerability": {"vulnId": "EDB-14146", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-22T14:05:13+00:00"}, "gcve": {"gna": 1, "object_uuid": "e21c51a4-c763-4cfa-b829-93bd06110368", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-10-22T14:05:13+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-10-22T14:05:13+00:00", "first_seen_at": "2024-10-22T14:05:13+00:00"}, "scope": {"notes": "Affected: Ubiquiti / Nanostation5 (Air OS) | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-03-03: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-14146", "url": "https://www.exploit-db.com/exploits/14146"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ubiquiti", "30d_avg": 0, "90d_avg": 0, "product": "Nanostation5 (Air OS)", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-03", "vulnerability_class": "CVSS", "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "19565a9e-5447-4a3a-ae3f-ae2b0c861653", "vulnerability": {"vulnId": "CVE-2017-6334", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-21T18:33:29+00:00"}, "gcve": {"gna": 1, "object_uuid": "19565a9e-5447-4a3a-ae3f-ae2b0c861653", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-10-21T18:33:29+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-10-21T18:33:29+00:00", "first_seen_at": "2024-10-21T18:33:29+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR DGN2200 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2023-03-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-6334", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6334"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "NETGEAR", "30d_avg": 1, "90d_avg": 0, "product": "NETGEAR DGN2200", "cisa_kev": "yes", "connections": 1, "observation_date": "2023-03-04", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "6b22d18a-6361-42df-91ca-23ce420fecab", "vulnerability": {"vulnId": "CNVD-2021-14544", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-18T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6b22d18a-6361-42df-91ca-23ce420fecab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-08-07T15:57:17+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-18T00:00:00+00:00", "first_seen_at": "2024-08-07T15:57:17+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision Streaming Media Management Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2024-10-18: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Hikvision Streaming Media Management Server", "cisa_kev": "no", "connections": 1, "observation_date": "2024-10-18", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "68b2c6bc-b72b-4ca4-9e9a-e85bf2e48655", "vulnerability": {"vulnId": "CVE-2018-1000861", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-17T15:51:55+00:00"}, "gcve": {"gna": 1, "object_uuid": "68b2c6bc-b72b-4ca4-9e9a-e85bf2e48655", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-17T15:51:55+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-10-17T15:51:55+00:00", "first_seen_at": "2024-10-17T15:51:55+00:00"}, "scope": {"notes": "Affected: Jenkins / Jenkins | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-02-27: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-1000861", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000861"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Jenkins", "30d_avg": 0, "90d_avg": 0, "product": "Jenkins", "cisa_kev": "yes", "connections": 2, "observation_date": "2023-02-27", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a4f1590a-4101-4af4-821a-0a4eaa7e173a", "vulnerability": {"vulnId": "CVE-2020-10826", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T07:52:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "a4f1590a-4101-4af4-821a-0a4eaa7e173a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-12T07:52:41+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T07:52:41+00:00", "first_seen_at": "2024-10-12T07:52:41+00:00"}, "scope": {"notes": "Affected: Draytek / Draytek Vigor3900, Vigor2960, Vigor300B | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-12: 41", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10826", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10826"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Draytek", "30d_avg": 0, "90d_avg": 0, "product": "Draytek Vigor3900, Vigor2960, Vigor300B", "cisa_kev": "no", "connections": 41, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f21fcba0-2135-4a12-8e81-f14338c5574d", "vulnerability": {"vulnId": "CVE-2018-20334", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T07:52:39+00:00"}, "gcve": {"gna": 1, "object_uuid": "f21fcba0-2135-4a12-8e81-f14338c5574d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-12T07:52:39+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T07:52:39+00:00", "first_seen_at": "2024-10-12T07:52:39+00:00"}, "scope": {"notes": "Affected: ASUS / ASUSWRT | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-12: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-20334", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20334"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ASUS", "30d_avg": 0, "90d_avg": 0, "product": "ASUSWRT", "cisa_kev": "no", "connections": 51, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "6bf2bee5-5e9f-454b-94f2-a16711643d25", "vulnerability": {"vulnId": "CVE-2019-1652", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T07:52:33+00:00"}, "gcve": {"gna": 1, "object_uuid": "6bf2bee5-5e9f-454b-94f2-a16711643d25", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2024-10-12T07:52:33+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T07:52:33+00:00", "first_seen_at": "2024-10-12T07:52:33+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV320/RV325 | Class: router | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-10-12: 41", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-1652", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1652"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco RV320/RV325", "cisa_kev": "yes", "connections": 41, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "901c98ac-950b-4011-9b85-964d120b33f4", "vulnerability": {"vulnId": "CVE-2023-0611", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T07:52:27+00:00"}, "gcve": {"gna": 1, "object_uuid": "901c98ac-950b-4011-9b85-964d120b33f4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-10-12T07:52:27+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T07:52:27+00:00", "first_seen_at": "2024-10-12T07:52:27+00:00"}, "scope": {"notes": "Affected: TRENDnet / TRENDnet TEW-652BRP | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-12: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0611", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0611"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "TRENDnet", "30d_avg": 0, "90d_avg": 0, "product": "TRENDnet TEW-652BRP", "cisa_kev": "no", "connections": 51, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "f11e3b67-863c-429a-bf64-55e53e7d957f", "vulnerability": {"vulnId": "CVE-2019-3914", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f11e3b67-863c-429a-bf64-55e53e7d957f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2024-08-28T01:49:06+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T00:00:00+00:00", "first_seen_at": "2024-08-28T01:49:06+00:00"}, "scope": {"notes": "Affected: Verizon /  Verizon Fios Quantum Gateway (G1100) | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-12: 51", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-3914", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3914"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Verizon", "30d_avg": 0, "90d_avg": 0, "product": " Verizon Fios Quantum Gateway (G1100)", "cisa_kev": "no", "connections": 51, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}]}
{"uuid": "bf259e44-fa87-4861-b1de-213523860ae0", "vulnerability": {"vulnId": "CVE-2020-10215", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "bf259e44-fa87-4861-b1de-213523860ae0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-28T01:48:07+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-12T00:00:00+00:00", "first_seen_at": "2024-08-28T01:48:07+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-825 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-12: 41", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-10215", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10215"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-825", "cisa_kev": "no", "connections": 41, "observation_date": "2024-10-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "51bceadc-eed1-4cdf-869b-10fc674a6cba", "vulnerability": {"vulnId": "CVE-2021-39509", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-09T03:25:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "51bceadc-eed1-4cdf-869b-10fc674a6cba", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-09T03:25:41+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-09T03:25:41+00:00", "first_seen_at": "2024-10-09T03:25:41+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-816/DIR-816A2 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-09: 81", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-39509", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39509"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-816/DIR-816A2", "cisa_kev": "no", "connections": 81, "observation_date": "2024-10-09", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "7652485c-e66c-4b17-b340-89b4b623da65", "vulnerability": {"vulnId": "CVE-2017-17105", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-06T21:57:18+00:00"}, "gcve": {"gna": 1, "object_uuid": "7652485c-e66c-4b17-b340-89b4b623da65", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-06T21:57:18+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-06T21:57:18+00:00", "first_seen_at": "2024-10-06T21:57:18+00:00"}, "scope": {"notes": "Affected: Zivif / Zivif PR115-204-P-RS | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-06: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-17105", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17105"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Zivif", "30d_avg": 0, "90d_avg": 0, "product": "Zivif PR115-204-P-RS", "cisa_kev": "no", "connections": 14, "observation_date": "2024-10-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "eeccf09a-5ad9-4893-b383-6217a2e76c74", "vulnerability": {"vulnId": "EDB-52074", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-06T09:13:45+00:00"}, "gcve": {"gna": 1, "object_uuid": "eeccf09a-5ad9-4893-b383-6217a2e76c74", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-10-06T09:13:45+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-06T09:13:45+00:00", "first_seen_at": "2024-10-06T09:13:45+00:00"}, "scope": {"notes": "Affected: HPE Aruba / Aruba 501 | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-06: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-52074", "url": "https://www.exploit-db.com/exploits/52074"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "HPE Aruba", "30d_avg": 0, "90d_avg": 0, "product": "Aruba 501", "cisa_kev": "no", "connections": 2, "observation_date": "2024-10-06", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "19c501a4-a855-4ff9-abff-8b1dabbd4892", "vulnerability": {"vulnId": "CVE-2018-13307", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "19c501a4-a855-4ff9-abff-8b1dabbd4892", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-10-05T16:53:05+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-06T00:00:00+00:00", "first_seen_at": "2024-10-05T16:53:05+00:00"}, "scope": {"notes": "Affected: Totolink / A3002RU | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-06: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-13307", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13307"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "A3002RU", "cisa_kev": "no", "connections": 17, "observation_date": "2024-10-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "50ff131d-0db2-4b7f-b9b8-d7558867b0c7", "vulnerability": {"vulnId": "CVE-2022-29013", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-10-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "50ff131d-0db2-4b7f-b9b8-d7558867b0c7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-18T08:55:48+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-10-02T00:00:00+00:00", "first_seen_at": "2024-09-18T08:55:48+00:00"}, "scope": {"notes": "Affected: Razer / Razer Sila | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-10-02: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-29013", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29013"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Razer", "30d_avg": 0, "90d_avg": 0, "product": "Razer Sila", "cisa_kev": "no", "connections": 1, "observation_date": "2024-10-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "45859cb6-b95e-4412-b8e2-5171d934f694", "vulnerability": {"vulnId": "CVE-2015-1187", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-09-29T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "45859cb6-b95e-4412-b8e2-5171d934f694", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-23T21:46:53+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-09-29T00:00:00+00:00", "first_seen_at": "2024-09-23T21:46:53+00:00"}, "scope": {"notes": "Affected: D-Link/TRENDnet / D-Link/TRENDnet multiple devices | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2024-09-29: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-1187", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1187"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link/TRENDnet", "30d_avg": 0, "90d_avg": 0, "product": "D-Link/TRENDnet multiple devices", "cisa_kev": "yes", "connections": 1, "observation_date": "2024-09-29", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1e76b4e7-da20-478b-8e79-4b9ae1a42440", "vulnerability": {"vulnId": "CVE-2023-40044", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-09-27T15:32:21+00:00"}, "gcve": {"gna": 1, "object_uuid": "1e76b4e7-da20-478b-8e79-4b9ae1a42440", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-09-27T15:32:21+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-09-27T15:32:21+00:00", "first_seen_at": "2024-09-27T15:32:21+00:00"}, "scope": {"notes": "Affected: Progress / WS_FTP Server | Class: file-transfer | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-09-27: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-40044", "url": "https://www.cve.org/CVERecord?id=CVE-2023-40044"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 0, "product": "WS_FTP Server", "cisa_kev": "yes", "connections": 2, "observation_date": "2024-09-27", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "050710a2-1d62-4ea6-9df0-2c97a1b7c09f", "vulnerability": {"vulnId": "EDB-48377", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-09-14T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "050710a2-1d62-4ea6-9df0-2c97a1b7c09f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-08-09T05:01:35+00:00", "recorded_at": "2026-06-30T12:07:41+00:00", "last_seen_at": "2024-09-14T00:00:00+00:00", "first_seen_at": "2024-08-09T05:01:35+00:00"}, "scope": {"notes": "Affected: Edimax / Edimax EW-7438RPn | Class: wireless-extender | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-09-14: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-48377", "url": "https://www.exploit-db.com/exploits/48377"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "wireless-extender", "7d_avg": 0, "vendor": "Edimax", "30d_avg": 0, "90d_avg": 0, "product": "Edimax EW-7438RPn", "cisa_kev": "no", "connections": 2, "observation_date": "2024-09-14", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "7d77a9a8-f410-49df-a19f-d1b209b5e6f8", "vulnerability": {"vulnId": "CVE-2019-17621", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-09-08T02:10:50+00:00"}, "gcve": {"gna": 1, "object_uuid": "7d77a9a8-f410-49df-a19f-d1b209b5e6f8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-09-08T02:10:50+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2024-09-08T02:10:50+00:00", "first_seen_at": "2024-09-08T02:10:50+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-859 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-05-19: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-17621", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17621"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-859", "cisa_kev": "no", "connections": 2, "observation_date": "2023-05-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ff02eadd-0922-46da-9318-77d91ad13f73", "vulnerability": {"vulnId": "CVE-2018-9866", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-08-27T18:11:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "ff02eadd-0922-46da-9318-77d91ad13f73", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-27T18:11:41+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-08-27T18:11:41+00:00", "first_seen_at": "2024-08-27T18:11:41+00:00"}, "scope": {"notes": "Affected: SonicWall / SonicWall Global Management System | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-02: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-9866", "url": "https://www.cve.org/CVERecord?id=CVE-2018-9866"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "SonicWall", "30d_avg": 2, "90d_avg": 0, "product": "SonicWall Global Management System", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "43abc17a-1be0-4ba7-b3cd-e5dd937ecb30", "vulnerability": {"vulnId": "CVE-2023-24489", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-08-23T14:39:11+00:00"}, "gcve": {"gna": 1, "object_uuid": "43abc17a-1be0-4ba7-b3cd-e5dd937ecb30", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-23T14:39:11+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-08-23T14:39:11+00:00", "first_seen_at": "2024-08-23T14:39:11+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix ShareFile StorageZones (aka storage zones) Controller | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-08-15: 4299", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-24489", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24489"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "72", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 10, "vendor": "Citrix", "30d_avg": 2, "90d_avg": 0, "product": "Citrix ShareFile StorageZones (aka storage zones) Controller", "cisa_kev": "no", "connections": 4299, "observation_date": "2023-08-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "1cb34dce-f5e5-4ddb-a721-0bd66f5938f6", "vulnerability": {"vulnId": "CVE-2018-20841", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-08-05T17:06:21+00:00"}, "gcve": {"gna": 1, "object_uuid": "1cb34dce-f5e5-4ddb-a721-0bd66f5938f6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-08-05T17:06:21+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-08-05T17:06:21+00:00", "first_seen_at": "2024-08-05T17:06:21+00:00"}, "scope": {"notes": "Affected: HooToo / HooToo TripMate Titan HT-TM05 and HT-05 routers  | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-09-30: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-20841", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20841"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "HooToo", "30d_avg": 0, "90d_avg": 0, "product": "HooToo TripMate Titan HT-TM05 and HT-05 routers ", "cisa_kev": "no", "connections": 2, "observation_date": "2022-09-30", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "261f078d-c436-40a2-b658-a369506d4996", "vulnerability": {"vulnId": "CVE-2024-32113", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-28T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "261f078d-c436-40a2-b658-a369506d4996", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-06-14T08:40:40+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-28T00:00:00+00:00", "first_seen_at": "2024-06-14T08:40:40+00:00"}, "scope": {"notes": "Affected: Apache / OFBiz | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-28: 1185", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-32113", "url": "https://www.cve.org/CVERecord?id=CVE-2024-32113"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "OFBiz", "cisa_kev": "no", "connections": 1185, "observation_date": "2024-07-28", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "a72f807b-519b-4ed1-8cb6-a58786e1d85b", "vulnerability": {"vulnId": "EDB-42114", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-27T20:24:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "a72f807b-519b-4ed1-8cb6-a58786e1d85b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-07-27T20:24:14+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-07-27T20:24:14+00:00", "first_seen_at": "2024-07-27T20:24:14+00:00"}, "scope": {"notes": "Affected: EnGenius / EnGenius EnShare IoT Gigabit Cloud Service | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-09-06: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-42114", "url": "https://www.exploit-db.com/exploits/42114"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "EnGenius", "30d_avg": 0, "90d_avg": 0, "product": "EnGenius EnShare IoT Gigabit Cloud Service", "cisa_kev": "no", "connections": 1, "observation_date": "2023-09-06", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6e3a2bd6-f233-496f-a68f-3a097bc739c7", "vulnerability": {"vulnId": "CVE-2020-29557", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-27T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "6e3a2bd6-f233-496f-a68f-3a097bc739c7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-13T00:44:19+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-27T00:00:00+00:00", "first_seen_at": "2024-07-13T00:44:19+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-825 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2024-07-27: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-29557", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29557"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-825", "cisa_kev": "yes", "connections": 1, "observation_date": "2024-07-27", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b4b1b141-d2c1-4a5e-b362-eaf9209a659b", "vulnerability": {"vulnId": "CVE-2023-27034", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-26T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "b4b1b141-d2c1-4a5e-b362-eaf9209a659b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-22T00:37:59+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-26T00:00:00+00:00", "first_seen_at": "2024-06-22T00:37:59+00:00"}, "scope": {"notes": "Affected: PrestaShop / PrestaShop jmsblog | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-26: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-27034", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27034"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "PrestaShop", "30d_avg": 0, "90d_avg": 0, "product": "PrestaShop jmsblog", "cisa_kev": "no", "connections": 2, "observation_date": "2024-07-26", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "cbb7a49a-49a7-46fe-a31c-e785fb81a99e", "vulnerability": {"vulnId": "CNVD-2024-15077", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-24T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "cbb7a49a-49a7-46fe-a31c-e785fb81a99e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-06-30T00:35:42+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-24T00:00:00+00:00", "first_seen_at": "2024-06-30T00:35:42+00:00"}, "scope": {"notes": "Affected: anji-plus / AJ-Report | Class: business-intelligence | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-24: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "business-intelligence", "7d_avg": 0, "vendor": "anji-plus", "30d_avg": 0, "90d_avg": 0, "product": "AJ-Report", "cisa_kev": "no", "connections": 1, "observation_date": "2024-07-24", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6e8a7eeb-c166-494a-8931-1f1d7cb1384e", "vulnerability": {"vulnId": "CVE-2020-25540", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-21T15:19:46+00:00"}, "gcve": {"gna": 1, "object_uuid": "6e8a7eeb-c166-494a-8931-1f1d7cb1384e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-07-21T15:19:46+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-21T15:19:46+00:00", "first_seen_at": "2024-07-21T15:19:46+00:00"}, "scope": {"notes": "Affected: ThinkAdmin / ThinkAdmin | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-21: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-25540", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25540"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ThinkAdmin", "30d_avg": 0, "90d_avg": 0, "product": "ThinkAdmin", "cisa_kev": "no", "connections": 6, "observation_date": "2024-07-21", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "722de8d3-d5de-4516-933e-334161a1d245", "vulnerability": {"vulnId": "CVE-2024-5217", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-20T14:05:12+00:00"}, "gcve": {"gna": 1, "object_uuid": "722de8d3-d5de-4516-933e-334161a1d245", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-07-20T14:05:12+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-20T14:05:12+00:00", "first_seen_at": "2024-07-20T14:05:12+00:00"}, "scope": {"notes": "Affected: ServiceNow / Now Platform (Washington DC, Vancouver, and earlier releases) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-20: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-5217", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5217"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "ServiceNow", "30d_avg": 0, "90d_avg": 0, "product": "Now Platform (Washington DC, Vancouver, and earlier releases)", "cisa_kev": "no", "connections": 6, "observation_date": "2024-07-20", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "01501025-ccde-47d0-9ae5-f6264f1c8405", "vulnerability": {"vulnId": "CVE-2021-44892", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-15T17:54:28+00:00"}, "gcve": {"gna": 1, "object_uuid": "01501025-ccde-47d0-9ae5-f6264f1c8405", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-07-15T17:54:28+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-15T17:54:28+00:00", "first_seen_at": "2024-07-15T17:54:28+00:00"}, "scope": {"notes": "Affected: TopThink / ThinkPHP3 | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-44892", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44892"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "TopThink", "30d_avg": 0, "90d_avg": 0, "product": "ThinkPHP3", "cisa_kev": "no", "connections": 1, "observation_date": "2024-07-15", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "f2f492d6-c4b2-40bc-bc1d-3f7293baf36b", "vulnerability": {"vulnId": "CVE-2022-25237", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-12T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2f492d6-c4b2-40bc-bc1d-3f7293baf36b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-05-15T10:47:42+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-12T00:00:00+00:00", "first_seen_at": "2024-05-15T10:47:42+00:00"}, "scope": {"notes": "Affected: Bonitasoft / Bonitasoft | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-12: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25237", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25237"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Bonitasoft", "30d_avg": 0, "90d_avg": 0, "product": "Bonitasoft", "cisa_kev": "no", "connections": 1, "observation_date": "2024-07-12", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d0866798-003a-4aa9-a5b8-0ffa432a4185", "vulnerability": {"vulnId": "CVE-2024-5806", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-05T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "d0866798-003a-4aa9-a5b8-0ffa432a4185", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 74}, "timestamps": {"asserted_at": "2024-06-26T02:17:51+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-05T00:00:00+00:00", "first_seen_at": "2024-06-26T02:17:51+00:00"}, "scope": {"notes": "Affected: Progress / MOVEit Transfer | Class: other-software | Severity: High (CVSS 7.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-07-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-5806", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5806"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Progress", "30d_avg": 1, "90d_avg": 0, "product": "MOVEit Transfer", "cisa_kev": "no", "connections": 1, "observation_date": "2024-07-05", "vulnerability_class": "CVSS", "vulnerability_score": 7.4, "vulnerability_severity": "High"}}]}
{"uuid": "0e6d5e65-744f-4ad8-bdd0-8c5250126896", "vulnerability": {"vulnId": "CVE-2024-22729", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-07-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0e6d5e65-744f-4ad8-bdd0-8c5250126896", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-27T07:46:34+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-07-02T00:00:00+00:00", "first_seen_at": "2024-06-27T07:46:34+00:00"}, "scope": {"notes": "Affected: Netis / Netis MW5360 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-07-02: 339", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-22729", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22729"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Netis", "30d_avg": 0, "90d_avg": 0, "product": "Netis MW5360", "cisa_kev": "no", "connections": 339, "observation_date": "2024-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ad0f4657-215d-4fac-990c-0736a57b3ffc", "vulnerability": {"vulnId": "CVE-2019-20504", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-06-29T17:09:04+00:00"}, "gcve": {"gna": 1, "object_uuid": "ad0f4657-215d-4fac-990c-0736a57b3ffc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-06-29T17:09:04+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-06-29T17:09:04+00:00", "first_seen_at": "2024-06-29T17:09:04+00:00"}, "scope": {"notes": "Affected: Quest / Quest KACE K1000 Systems Management Appliance  | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-20504", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20504"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Quest", "30d_avg": 0, "90d_avg": 0, "product": "Quest KACE K1000 Systems Management Appliance ", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-09", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "98fa9144-4a06-4b85-8589-42a2f78b0187", "vulnerability": {"vulnId": "CVE-2023-50358", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-06-25T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "98fa9144-4a06-4b85-8589-42a2f78b0187", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-05-16T12:09:05+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-06-25T00:00:00+00:00", "first_seen_at": "2024-05-16T12:09:05+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS and QuTS Hero | Class: nas | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-06-25: 1287", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-50358", "url": "https://www.cve.org/CVERecord?id=CVE-2023-50358"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP QTS and QuTS Hero", "cisa_kev": "no", "connections": 1287, "observation_date": "2024-06-25", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "d85d2e7d-b96c-427b-a3be-782450727bf4", "vulnerability": {"vulnId": "CVE-2024-27130", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-27T10:48:06+00:00"}, "gcve": {"gna": 1, "object_uuid": "d85d2e7d-b96c-427b-a3be-782450727bf4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2024-05-27T10:48:06+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-05-27T10:48:06+00:00", "first_seen_at": "2024-05-27T10:48:06+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS, QuTSCloud, QuTS Hero | Class: nas | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-05-27: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-27130", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27130"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP QTS, QuTSCloud, QuTS Hero", "cisa_kev": "no", "connections": 4, "observation_date": "2024-05-27", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "6a966487-9af1-44be-8d44-eb87975a4e4d", "vulnerability": {"vulnId": "SSV-97217", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-25T15:12:12+00:00"}, "gcve": {"gna": 1, "object_uuid": "6a966487-9af1-44be-8d44-eb87975a4e4d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-05-25T15:12:12+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2024-05-25T15:12:12+00:00", "first_seen_at": "2024-05-25T15:12:12+00:00"}, "scope": {"notes": "Affected: Shenzhen TVT / Shenzhen TVT Digital Technology DVR/NVR/IPC | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-29: 54", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "10", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 10, "vendor": "Shenzhen TVT", "30d_avg": 11, "90d_avg": 20, "product": "Shenzhen TVT Digital Technology DVR/NVR/IPC", "cisa_kev": "no", "connections": 54, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "36ff039e-a2fc-47a9-96d6-a0cf76072253", "vulnerability": {"vulnId": "CVE-2019-2618", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-22T09:51:43+00:00"}, "gcve": {"gna": 1, "object_uuid": "36ff039e-a2fc-47a9-96d6-a0cf76072253", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 55}, "timestamps": {"asserted_at": "2024-05-22T09:51:43+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2024-05-22T09:51:43+00:00", "first_seen_at": "2024-05-22T09:51:43+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | IoT: no | In CISA KEV: no | Honeypot connections on 2022-07-08: 53", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-2618", "url": "https://www.cve.org/CVERecord?id=CVE-2019-2618"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle Weblogic Server", "cisa_kev": "no", "connections": 53, "observation_date": "2022-07-08", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "dd5b40ca-24b4-4d22-a32a-2051502e0328", "vulnerability": {"vulnId": "CVE-2022-1883", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-15T11:07:58+00:00"}, "gcve": {"gna": 1, "object_uuid": "dd5b40ca-24b4-4d22-a32a-2051502e0328", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-05-15T11:07:58+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-05-15T11:07:58+00:00", "first_seen_at": "2024-05-15T11:07:58+00:00"}, "scope": {"notes": "Affected: camptocamp / Terraboard | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-01: 357", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1883"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "camptocamp", "30d_avg": 0, "90d_avg": 0, "product": "Terraboard", "cisa_kev": "no", "connections": 357, "observation_date": "2023-03-01", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "b6a66ee9-8be3-4791-a14d-de6dc3840bb9", "vulnerability": {"vulnId": "CVE-2017-5173", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-15T10:53:22+00:00"}, "gcve": {"gna": 1, "object_uuid": "b6a66ee9-8be3-4791-a14d-de6dc3840bb9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-05-15T10:53:22+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-05-15T10:53:22+00:00", "first_seen_at": "2024-05-15T10:53:22+00:00"}, "scope": {"notes": "Affected: Geutebruck / G-Cam/EFD-2250 | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-05-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-5173", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5173"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Geutebruck", "30d_avg": 0, "90d_avg": 0, "product": "G-Cam/EFD-2250", "cisa_kev": "no", "connections": 1, "observation_date": "2024-05-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "52134ace-e66d-493f-80a9-fcdb386480ce", "vulnerability": {"vulnId": "CVE-2022-36267", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-05-15T10:49:15+00:00"}, "gcve": {"gna": 1, "object_uuid": "52134ace-e66d-493f-80a9-fcdb386480ce", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-05-15T10:49:15+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-05-15T10:49:15+00:00", "first_seen_at": "2024-05-15T10:49:15+00:00"}, "scope": {"notes": "Affected: Airspan / Airspot 5410 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-05-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36267", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36267"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Airspan", "30d_avg": 0, "90d_avg": 0, "product": "Airspot 5410", "cisa_kev": "no", "connections": 1, "observation_date": "2024-05-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "0d34558a-d5f9-4c7f-a04a-be50f1a66575", "vulnerability": {"vulnId": "CVE-2023-4473", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-30T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "0d34558a-d5f9-4c7f-a04a-be50f1a66575", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-28T13:50:19+00:00", "recorded_at": "2026-06-30T12:19:49+00:00", "last_seen_at": "2024-04-30T00:00:00+00:00", "first_seen_at": "2024-04-28T13:50:19+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NAS326/NAS542 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-04-30: 333", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-4473", "url": "https://www.cve.org/CVERecord?id=CVE-2023-4473"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Zyxel NAS326/NAS542", "cisa_kev": "no", "connections": 333, "observation_date": "2024-04-30", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b71d29b1-f9dd-434b-a531-37d69701d07c", "vulnerability": {"vulnId": "CVE-2021-32790", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-20T23:02:38+00:00"}, "gcve": {"gna": 1, "object_uuid": "b71d29b1-f9dd-434b-a531-37d69701d07c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 49}, "timestamps": {"asserted_at": "2024-04-20T23:02:38+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-20T23:02:38+00:00", "first_seen_at": "2024-04-20T23:02:38+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Woocommerce plugin | Class: cms | Severity: Medium (CVSS 4.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-04-20: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-32790", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32790"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Woocommerce plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2024-04-20", "vulnerability_class": "CVSS", "vulnerability_score": 4.9, "vulnerability_severity": "Medium"}}]}
{"uuid": "a1b68244-ae45-479d-b0fb-ed65d9d9c9aa", "vulnerability": {"vulnId": "CVE-2019-4061", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-15T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a1b68244-ae45-479d-b0fb-ed65d9d9c9aa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2024-04-08T07:11:31+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-15T00:00:00+00:00", "first_seen_at": "2024-04-08T07:11:31+00:00"}, "scope": {"notes": "Affected: IBM / BigFix | Class: device-management-platform | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-04-15: 283", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-4061", "url": "https://www.cve.org/CVERecord?id=CVE-2019-4061"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "29", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 4, "vendor": "IBM", "30d_avg": 1, "90d_avg": 0, "product": "BigFix", "cisa_kev": "no", "connections": 283, "observation_date": "2024-04-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "fb1753c1-a793-4b70-9733-4244bfd97ddb", "vulnerability": {"vulnId": "CVE-2024-0778", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-13T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "fb1753c1-a793-4b70-9733-4244bfd97ddb", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-15T12:14:52+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-13T00:00:00+00:00", "first_seen_at": "2024-03-15T12:14:52+00:00"}, "scope": {"notes": "Affected: Uniview / Uniview ISC 2500-S | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-04-13: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-0778", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0778"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Uniview", "30d_avg": 0, "90d_avg": 0, "product": "Uniview ISC 2500-S", "cisa_kev": "no", "connections": 10, "observation_date": "2024-04-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "8f9a1b4c-8d3c-4bd8-880e-a3f250354907", "vulnerability": {"vulnId": "EDB-51096", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8f9a1b4c-8d3c-4bd8-880e-a3f250354907", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-04-09T12:34:29+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-10T00:00:00+00:00", "first_seen_at": "2024-04-09T12:34:29+00:00"}, "scope": {"notes": "Affected: MiniDVBLinux / MiniDVBLinux | Class: embedded-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-04-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-51096", "url": "https://www.exploit-db.com/exploits/51096"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "MiniDVBLinux", "30d_avg": 0, "90d_avg": 0, "product": "MiniDVBLinux", "cisa_kev": "no", "connections": 1, "observation_date": "2024-04-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "ddff8dd5-fcc3-44e5-be91-65556436678f", "vulnerability": {"vulnId": "CVE-2024-1021", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-04T00:46:56+00:00"}, "gcve": {"gna": 1, "object_uuid": "ddff8dd5-fcc3-44e5-be91-65556436678f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-04-04T00:46:56+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-04T00:46:56+00:00", "first_seen_at": "2024-04-04T00:46:56+00:00"}, "scope": {"notes": "Affected: Rebuild / Rebuild | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-04-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-1021", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1021"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rebuild", "30d_avg": 0, "90d_avg": 0, "product": "Rebuild", "cisa_kev": "no", "connections": 1, "observation_date": "2024-04-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4e498131-d5d1-4b68-8333-b1c9bcd8457a", "vulnerability": {"vulnId": "CVE-2024-21762", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-04-02T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "4e498131-d5d1-4b68-8333-b1c9bcd8457a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-18T15:11:53+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-04-02T00:00:00+00:00", "first_seen_at": "2024-03-18T15:11:53+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiOS and FortiProxy | Class: firewall | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-04-02: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2024-21762", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Fortinet", "30d_avg": 0, "90d_avg": 0, "product": "FortiOS and FortiProxy", "cisa_kev": "yes", "connections": 2, "observation_date": "2024-04-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "b855d3c7-2f42-4825-be38-286fbd1cf2b2", "vulnerability": {"vulnId": "CVE-2023-39296", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-24T07:08:16+00:00"}, "gcve": {"gna": 1, "object_uuid": "b855d3c7-2f42-4825-be38-286fbd1cf2b2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-03-24T07:08:16+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-03-24T07:08:16+00:00", "first_seen_at": "2024-03-24T07:08:16+00:00"}, "scope": {"notes": "Affected: QNAP / QTS and QuTS Hero | Class: nas | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-03-24: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-39296", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39296"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QTS and QuTS Hero", "cisa_kev": "no", "connections": 1, "observation_date": "2024-03-24", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "219761c7-3d1a-4eeb-8fc2-e6365b513815", "vulnerability": {"vulnId": "EDB-50775", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-21T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "219761c7-3d1a-4eeb-8fc2-e6365b513815", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-03-13T07:41:39+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-03-21T00:00:00+00:00", "first_seen_at": "2024-03-13T07:41:39+00:00"}, "scope": {"notes": "Affected: Dbltek / Dbltek GoIP | Class: ip-pbx | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-03-21: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-50775", "url": "https://www.exploit-db.com/exploits/50775"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "Dbltek", "30d_avg": 0, "90d_avg": 0, "product": "Dbltek GoIP", "cisa_kev": "no", "connections": 5, "observation_date": "2024-03-21", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2e28671b-a6e2-49fa-b471-3594d40f40c1", "vulnerability": {"vulnId": "CVE-2013-1599", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-13T07:41:34+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e28671b-a6e2-49fa-b471-3594d40f40c1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-13T07:41:34+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-03-13T07:41:34+00:00", "first_seen_at": "2024-03-13T07:41:34+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link IP Cameras | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-03-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2013-1599", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1599"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "D-Link", "30d_avg": 2, "90d_avg": 1, "product": "D-Link IP Cameras", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "97a1ede4-827c-45ea-81af-e18a23edc706", "vulnerability": {"vulnId": "CVE-2023-25717", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-06T20:59:51+00:00"}, "gcve": {"gna": 1, "object_uuid": "97a1ede4-827c-45ea-81af-e18a23edc706", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-03-06T20:59:51+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-03-06T20:59:51+00:00", "first_seen_at": "2024-03-06T20:59:51+00:00"}, "scope": {"notes": "Affected: Ruckus / Ruckus Wireless Admin | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2023-09-28: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-25717", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25717"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ruckus", "30d_avg": 0, "90d_avg": 0, "product": "Ruckus Wireless Admin", "cisa_kev": "yes", "connections": 1, "observation_date": "2023-09-28", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "f2b60b48-8f9a-49b3-97cb-012df678f736", "vulnerability": {"vulnId": "CVE-2023-26609", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-06T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "f2b60b48-8f9a-49b3-97cb-012df678f736", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-17T04:39:29+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-03-06T00:00:00+00:00", "first_seen_at": "2024-01-17T04:39:29+00:00"}, "scope": {"notes": "Affected: ABUS / ABUS TVIP 20000-21150 | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-03-06: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26609", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26609"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "ABUS", "30d_avg": 0, "90d_avg": 0, "product": "ABUS TVIP 20000-21150", "cisa_kev": "no", "connections": 3, "observation_date": "2024-03-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "4f1bfea8-6b9f-4661-94c1-9e3d49cc8b79", "vulnerability": {"vulnId": "CVE-2021-32849", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-03-04T03:07:48+00:00"}, "gcve": {"gna": 1, "object_uuid": "4f1bfea8-6b9f-4661-94c1-9e3d49cc8b79", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-03-04T03:07:48+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-03-04T03:07:48+00:00", "first_seen_at": "2024-03-04T03:07:48+00:00"}, "scope": {"notes": "Affected: Gerapy / Gerapy | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-03-04: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-32849", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32849"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Gerapy", "30d_avg": 0, "90d_avg": 0, "product": "Gerapy", "cisa_kev": "no", "connections": 1, "observation_date": "2024-03-04", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "e77d3f70-35a9-4ce0-a48d-ebdd44873228", "vulnerability": {"vulnId": "CVE-2020-15916", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-02-22T21:31:40+00:00"}, "gcve": {"gna": 1, "object_uuid": "e77d3f70-35a9-4ce0-a48d-ebdd44873228", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-22T21:31:40+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2024-02-22T21:31:40+00:00", "first_seen_at": "2024-02-22T21:31:40+00:00"}, "scope": {"notes": "Affected: Tenda / AC15/AC1900 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-05-19: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15916", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15916"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "AC15/AC1900", "cisa_kev": "no", "connections": 2, "observation_date": "2023-05-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "310472eb-fcc0-4dfa-a14e-2b5824505b9e", "vulnerability": {"vulnId": "CVE-2022-24086", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-02-17T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "310472eb-fcc0-4dfa-a14e-2b5824505b9e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-02-14T15:46:45+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-02-17T00:00:00+00:00", "first_seen_at": "2024-02-14T15:46:45+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe Commerce (Magento) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-02-17: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24086", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24086"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe Commerce (Magento)", "cisa_kev": "yes", "connections": 2, "observation_date": "2024-02-17", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "09cbfbfa-bb52-4016-9560-94593758d8e1", "vulnerability": {"vulnId": "CVE-2020-6308", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-02-14T02:06:55+00:00"}, "gcve": {"gna": 1, "object_uuid": "09cbfbfa-bb52-4016-9560-94593758d8e1", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2024-02-14T02:06:55+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2024-02-14T02:06:55+00:00", "first_seen_at": "2024-02-14T02:06:55+00:00"}, "scope": {"notes": "Affected: SAP / BusinessObjects Business Intelligence Platform (Web Services) | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-15: 301", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-6308", "url": "https://www.cve.org/CVERecord?id=CVE-2020-6308"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SAP", "30d_avg": 0, "90d_avg": 0, "product": "BusinessObjects Business Intelligence Platform (Web Services)", "cisa_kev": "no", "connections": 301, "observation_date": "2023-06-15", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}]}
{"uuid": "6d7fa7c4-6f07-4ca4-9110-2c501d52e9da", "vulnerability": {"vulnId": "CVE-2021-32819", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-02-07T14:34:24+00:00"}, "gcve": {"gna": 1, "object_uuid": "6d7fa7c4-6f07-4ca4-9110-2c501d52e9da", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-02-07T14:34:24+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2024-02-07T14:34:24+00:00", "first_seen_at": "2024-02-07T14:34:24+00:00"}, "scope": {"notes": "Affected: Squirrelly / Squirrelly | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-28: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-32819", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32819"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Squirrelly", "30d_avg": 0, "90d_avg": 0, "product": "Squirrelly", "cisa_kev": "no", "connections": 4, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "4913775d-cecf-4e09-90ef-7090a2fbe55f", "vulnerability": {"vulnId": "CVE-2023-23295", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-02-05T19:51:26+00:00"}, "gcve": {"gna": 1, "object_uuid": "4913775d-cecf-4e09-90ef-7090a2fbe55f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2024-02-05T19:51:26+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-02-05T19:51:26+00:00", "first_seen_at": "2024-02-05T19:51:26+00:00"}, "scope": {"notes": "Affected: Korenix / Jetwave 4200, Jetwave 3000 Series | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-02-05: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-23295", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23295"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Korenix", "30d_avg": 0, "90d_avg": 0, "product": "Jetwave 4200, Jetwave 3000 Series", "cisa_kev": "no", "connections": 1, "observation_date": "2024-02-05", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "ffe3f147-06f2-42a1-a363-00597be3daa9", "vulnerability": {"vulnId": "EDB-46319", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-31T20:10:10+00:00"}, "gcve": {"gna": 1, "object_uuid": "ffe3f147-06f2-42a1-a363-00597be3daa9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-01-31T20:10:10+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-01-31T20:10:10+00:00", "first_seen_at": "2024-01-31T20:10:10+00:00"}, "scope": {"notes": "Affected: BEWARD / BEWARD N100 H.264 VGA IP Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-08-21: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-46319", "url": "https://www.exploit-db.com/exploits/46319"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "BEWARD", "30d_avg": 0, "90d_avg": 0, "product": "BEWARD N100 H.264 VGA IP Camera", "cisa_kev": "no", "connections": 3, "observation_date": "2023-08-21", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "64e6e491-f31e-4b45-98d3-afe4fb586749", "vulnerability": {"vulnId": "CVE-2023-32315", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-20T02:40:56+00:00"}, "gcve": {"gna": 1, "object_uuid": "64e6e491-f31e-4b45-98d3-afe4fb586749", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2024-01-20T02:40:56+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-01-20T02:40:56+00:00", "first_seen_at": "2024-01-20T02:40:56+00:00"}, "scope": {"notes": "Affected: Ignite Realtime / Openfire | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-09-19: 87", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-32315", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32315"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Ignite Realtime", "30d_avg": 1, "90d_avg": 0, "product": "Openfire", "cisa_kev": "yes", "connections": 87, "observation_date": "2023-09-19", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "bb230d46-5c19-48c7-aede-32a3a5ce9add", "vulnerability": {"vulnId": "EDB-40344", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:53:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "bb230d46-5c19-48c7-aede-32a3a5ce9add", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2024-01-13T18:53:14+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2024-01-13T18:53:14+00:00", "first_seen_at": "2024-01-13T18:53:14+00:00"}, "scope": {"notes": "Affected: SugarCRM / SugarCRM | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2023-07-18: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-40344", "url": "https://www.exploit-db.com/exploits/40344"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "SugarCRM", "30d_avg": 0, "90d_avg": 0, "product": "SugarCRM", "cisa_kev": "no", "connections": 1, "observation_date": "2023-07-18", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f412c00f-7ca3-4f5f-8dc8-fb917f317834", "vulnerability": {"vulnId": "CVE-2019-25065", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:53:08+00:00"}, "gcve": {"gna": 1, "object_uuid": "f412c00f-7ca3-4f5f-8dc8-fb917f317834", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-13T18:53:08+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-01-13T18:53:08+00:00", "first_seen_at": "2024-01-13T18:53:08+00:00"}, "scope": {"notes": "Affected: OpenNetAdmin / OpenNetAdmin | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-25065", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25065"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "OpenNetAdmin", "30d_avg": 0, "90d_avg": 0, "product": "OpenNetAdmin", "cisa_kev": "no", "connections": 2, "observation_date": "2024-01-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "2e5aaf0f-0eac-458a-953b-794e22392c2b", "vulnerability": {"vulnId": "CVE-2011-5010", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:52:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "2e5aaf0f-0eac-458a-953b-794e22392c2b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2024-01-13T18:52:47+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2024-01-13T18:52:47+00:00", "first_seen_at": "2024-01-13T18:52:47+00:00"}, "scope": {"notes": "Affected: Ctek / SkyRouter | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-07-09: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2011-5010", "url": "https://www.cve.org/CVERecord?id=CVE-2011-5010"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ctek", "30d_avg": 0, "90d_avg": 0, "product": "SkyRouter", "cisa_kev": "no", "connections": 1, "observation_date": "2022-07-09", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "cc7da80b-05f6-40b1-ad0e-a602e6ef74ff", "vulnerability": {"vulnId": "CVE-2019-11043", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:52:25+00:00"}, "gcve": {"gna": 1, "object_uuid": "cc7da80b-05f6-40b1-ad0e-a602e6ef74ff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-13T18:52:25+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2024-01-13T18:52:25+00:00", "first_seen_at": "2024-01-13T18:52:25+00:00"}, "scope": {"notes": "Affected: PHP / PHP-FPM (FastCGI Process Manager) | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-06-18: 349", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-11043", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11043"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "PHP", "30d_avg": 0, "90d_avg": 0, "product": "PHP-FPM (FastCGI Process Manager)", "cisa_kev": "yes", "connections": 349, "observation_date": "2023-06-18", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "851765da-da2b-4de7-8f8e-b0a59d2ba0b5", "vulnerability": {"vulnId": "CVE-2021-3287", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:52:23+00:00"}, "gcve": {"gna": 1, "object_uuid": "851765da-da2b-4de7-8f8e-b0a59d2ba0b5", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-13T18:52:23+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2024-01-13T18:52:23+00:00", "first_seen_at": "2024-01-13T18:52:23+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine OpManager | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-15: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-3287", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3287"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Zoho", "30d_avg": 0, "90d_avg": 0, "product": "ManageEngine OpManager", "cisa_kev": "no", "connections": 2, "observation_date": "2023-03-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "45a79323-d45a-486d-924f-4aec12721f62", "vulnerability": {"vulnId": "CVE-2019-6814", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-13T18:51:58+00:00"}, "gcve": {"gna": 1, "object_uuid": "45a79323-d45a-486d-924f-4aec12721f62", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-13T18:51:58+00:00", "recorded_at": "2026-06-30T12:29:45+00:00", "last_seen_at": "2024-01-13T18:51:58+00:00", "first_seen_at": "2024-01-13T18:51:58+00:00"}, "scope": {"notes": "Affected: Schneider Electric / Pelco Endura NET55XX Encoder | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-01-13: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-6814", "url": "https://www.cve.org/CVERecord?id=CVE-2019-6814"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Schneider Electric", "30d_avg": 0, "90d_avg": 0, "product": "Pelco Endura NET55XX Encoder", "cisa_kev": "no", "connections": 2, "observation_date": "2024-01-13", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "e0d0328a-e74e-461d-a0a1-f90ac8b8bc2f", "vulnerability": {"vulnId": "CNVD-2020-68596", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "e0d0328a-e74e-461d-a0a1-f90ac8b8bc2f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-12-06T18:06:47+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2023-12-06T18:06:47+00:00"}, "scope": {"notes": "Affected: WeiPHP / WeiPHP | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-11: 141", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "WeiPHP", "30d_avg": 1, "90d_avg": 0, "product": "WeiPHP", "cisa_kev": "no", "connections": 141, "observation_date": "2024-01-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "5952a5c6-96a2-4226-9d20-eebf8f9eb675", "vulnerability": {"vulnId": "CVE-2017-17560", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "5952a5c6-96a2-4226-9d20-eebf8f9eb675", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-01T14:26:16+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2023-11-01T14:26:16+00:00"}, "scope": {"notes": "Affected: Western Digital / MyCloud PR4100 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2024-01-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-17560", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17560"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Western Digital", "30d_avg": 0, "90d_avg": 0, "product": "MyCloud PR4100", "cisa_kev": "no", "connections": 2, "observation_date": "2024-01-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "84fa431e-f6ae-4499-a889-9e7728cf5ff0", "vulnerability": {"vulnId": "CVE-2023-6553", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "84fa431e-f6ae-4499-a889-9e7728cf5ff0", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-16T21:33:47+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2023-12-16T21:33:47+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Backup Migration plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-11: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-6553", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6553"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 0, "product": "Wordpress Backup Migration plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2024-01-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ab250e78-294f-42f8-9f79-601b9b9fd6b6", "vulnerability": {"vulnId": "CVE-2022-0591", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "ab250e78-294f-42f8-9f79-601b9b9fd6b6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-14T18:04:27+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2023-10-14T18:04:27+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress FormCraft plugin | Class: cms | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-11: 166", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0591", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0591"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 1, "product": "Wordpress FormCraft plugin", "cisa_kev": "no", "connections": 166, "observation_date": "2024-01-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "9c80c80f-845a-4857-a0f9-1107c1471ddd", "vulnerability": {"vulnId": "CNVD-2021-33202", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "9c80c80f-845a-4857-a0f9-1107c1471ddd", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-12-10T21:56:27+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2023-12-10T21:56:27+00:00"}, "scope": {"notes": "Affected: Shanghai Fanwei Network Technology / Panwei e-cology | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-11: 178", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Shanghai Fanwei Network Technology", "30d_avg": 0, "90d_avg": 0, "product": "Panwei e-cology", "cisa_kev": "no", "connections": 178, "observation_date": "2024-01-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "8c5dddde-1f99-4d64-bf04-1043911ca589", "vulnerability": {"vulnId": "CVE-2017-8046", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-11T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "8c5dddde-1f99-4d64-bf04-1043911ca589", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-06T06:37:00+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-11T00:00:00+00:00", "first_seen_at": "2024-01-06T06:37:00+00:00"}, "scope": {"notes": "Affected: Spring / Spring Data REST | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-11: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-8046", "url": "https://www.cve.org/CVERecord?id=CVE-2017-8046"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Spring", "30d_avg": 0, "90d_avg": 0, "product": "Spring Data REST", "cisa_kev": "no", "connections": 8, "observation_date": "2024-01-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "17db6283-3d3b-45a1-9195-e9d4d23af400", "vulnerability": {"vulnId": "CNVD-2021-49104", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-10T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "17db6283-3d3b-45a1-9195-e9d4d23af400", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-12-10T21:56:29+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-10T00:00:00+00:00", "first_seen_at": "2023-12-10T21:56:29+00:00"}, "scope": {"notes": "Affected: Shanghai Fanwei Network Technology / Panwei e-office | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2024-01-10: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Shanghai Fanwei Network Technology", "30d_avg": 0, "90d_avg": 0, "product": "Panwei e-office", "cisa_kev": "no", "connections": 1, "observation_date": "2024-01-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a75e4a45-8714-4ddc-8426-62400ee38007", "vulnerability": {"vulnId": "CVE-2023-36845", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-09T00:00:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "a75e4a45-8714-4ddc-8426-62400ee38007", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-22T00:46:52+00:00", "recorded_at": "2026-06-30T14:08:36+00:00", "last_seen_at": "2024-01-09T00:00:00+00:00", "first_seen_at": "2023-10-22T00:46:52+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS (J-Web) | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-01-09: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-36845", "url": "https://www.cve.org/CVERecord?id=CVE-2023-36845"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Juniper", "30d_avg": 0, "90d_avg": 1, "product": "Junos OS (J-Web)", "cisa_kev": "yes", "connections": 4, "observation_date": "2024-01-09", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "427526f5-229a-4f71-b422-9884090a7496", "vulnerability": {"vulnId": "CVE-2020-5722", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2024-01-05T20:44:08+00:00"}, "gcve": {"gna": 1, "object_uuid": "427526f5-229a-4f71-b422-9884090a7496", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2024-01-05T20:44:08+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2024-01-05T20:44:08+00:00", "first_seen_at": "2024-01-05T20:44:08+00:00"}, "scope": {"notes": "Affected: Grandstream / UCM6200 series | Class: ip-pbx | IoT: yes | In CISA KEV: yes | Honeypot connections on 2022-08-07: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-5722", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5722"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ip-pbx", "7d_avg": 0, "vendor": "Grandstream", "30d_avg": 0, "90d_avg": 0, "product": "UCM6200 series", "cisa_kev": "yes", "connections": 3, "observation_date": "2022-08-07", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "1467eb86-65ae-4e39-8add-2bbaf7c3b0c8", "vulnerability": {"vulnId": "CVE-2021-20090", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-12-30T08:23:49+00:00"}, "gcve": {"gna": 1, "object_uuid": "1467eb86-65ae-4e39-8add-2bbaf7c3b0c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-30T08:23:49+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-12-30T08:23:49+00:00", "first_seen_at": "2023-12-30T08:23:49+00:00"}, "scope": {"notes": "Affected: Arcadyan / Arcadyan manufactured devices (multiple vendors) | Class: router | IoT: yes | In CISA KEV: yes | Honeypot connections on 2022-08-11: 32", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-20090", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20090"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Arcadyan", "30d_avg": 0, "90d_avg": 0, "product": "Arcadyan manufactured devices (multiple vendors)", "cisa_kev": "yes", "connections": 32, "observation_date": "2022-08-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6e28bbe2-930a-4abe-a13f-c4f2017b4489", "vulnerability": {"vulnId": "CVE-2019-8387", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-12-13T05:47:02+00:00"}, "gcve": {"gna": 1, "object_uuid": "6e28bbe2-930a-4abe-a13f-c4f2017b4489", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-13T05:47:02+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-12-13T05:47:02+00:00", "first_seen_at": "2023-12-13T05:47:02+00:00"}, "scope": {"notes": "Affected: Master / Master IP CAM 01 | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-02-26: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-8387", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8387"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Master", "30d_avg": 19, "90d_avg": 6, "product": "Master IP CAM 01", "cisa_kev": "no", "connections": 4, "observation_date": "2023-02-26", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "690c1aaa-e6c5-4898-94fb-47390c98c930", "vulnerability": {"vulnId": "CVE-2013-5948", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-12-12T22:51:43+00:00"}, "gcve": {"gna": 1, "object_uuid": "690c1aaa-e6c5-4898-94fb-47390c98c930", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-12-12T22:51:43+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-12-12T22:51:43+00:00", "first_seen_at": "2023-12-12T22:51:43+00:00"}, "scope": {"notes": "Affected: ASUS / ASUS RT series routers | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-06-20: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2013-5948", "url": "https://www.cve.org/CVERecord?id=CVE-2013-5948"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "ASUS", "30d_avg": 0, "90d_avg": 0, "product": "ASUS RT series routers", "cisa_kev": "no", "connections": 8, "observation_date": "2023-06-20", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "dabd6930-6cf3-4248-8f3a-0fc7ae100ca9", "vulnerability": {"vulnId": "CVE-2023-26360", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-12-06T18:25:51+00:00"}, "gcve": {"gna": 1, "object_uuid": "dabd6930-6cf3-4248-8f3a-0fc7ae100ca9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-06T18:25:51+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-12-06T18:25:51+00:00", "first_seen_at": "2023-12-06T18:25:51+00:00"}, "scope": {"notes": "Affected: Adobe / ColdFusion | Class: app-server | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-05-11: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-26360", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26360"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "ColdFusion", "cisa_kev": "yes", "connections": 1, "observation_date": "2023-05-11", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "50bd9ac7-e652-4fca-848f-3442ce9967d8", "vulnerability": {"vulnId": "CVE-2014-6271", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-12-01T14:54:48+00:00"}, "gcve": {"gna": 1, "object_uuid": "50bd9ac7-e652-4fca-848f-3442ce9967d8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-12-01T14:54:48+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-12-01T14:54:48+00:00", "first_seen_at": "2023-12-01T14:54:48+00:00"}, "scope": {"notes": "Affected: GNU / GNU Bash | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-07-16: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-6271", "url": "https://www.cve.org/CVERecord?id=CVE-2014-6271"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GNU", "30d_avg": 0, "90d_avg": 0, "product": "GNU Bash", "cisa_kev": "yes", "connections": 2, "observation_date": "2023-07-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "981135bb-2817-4ac3-add5-9588c8227248", "vulnerability": {"vulnId": "CVE-2022-22954", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-29T06:32:07+00:00"}, "gcve": {"gna": 1, "object_uuid": "981135bb-2817-4ac3-add5-9588c8227248", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-29T06:32:07+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-11-29T06:32:07+00:00", "first_seen_at": "2023-11-29T06:32:07+00:00"}, "scope": {"notes": "Affected: VMware / Workspace ONE Access and Identity Manager | Class: security-management-platform | IoT: no | In CISA KEV: yes | Honeypot connections on 2022-07-28: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-22954", "url": "https://www.cve.org/CVERecord?id=CVE-2022-22954"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "VMware", "30d_avg": 0, "90d_avg": 0, "product": "Workspace ONE Access and Identity Manager", "cisa_kev": "yes", "connections": 2, "observation_date": "2022-07-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a4d22020-49b9-4e5b-9117-e55664c19b89", "vulnerability": {"vulnId": "CVE-2017-17106", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-23T08:37:34+00:00"}, "gcve": {"gna": 1, "object_uuid": "a4d22020-49b9-4e5b-9117-e55664c19b89", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-23T08:37:34+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-11-23T08:37:34+00:00", "first_seen_at": "2023-11-23T08:37:34+00:00"}, "scope": {"notes": "Affected: Zivif / Zivif PR115-204-P-RS | Class: video-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-03-01: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-17106", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17106"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Zivif", "30d_avg": 0, "90d_avg": 0, "product": "Zivif PR115-204-P-RS", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-01", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d4289b4e-2307-4c31-8d3f-4ef57eb6effc", "vulnerability": {"vulnId": "CVE-2022-21661", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-15T23:17:33+00:00"}, "gcve": {"gna": 1, "object_uuid": "d4289b4e-2307-4c31-8d3f-4ef57eb6effc", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-11-15T23:17:33+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-11-15T23:17:33+00:00", "first_seen_at": "2023-11-15T23:17:33+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Core | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-02-13: 7", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-21661", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21661"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Core", "cisa_kev": "no", "connections": 7, "observation_date": "2023-02-13", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "fcd2e274-a260-477d-8579-39570ce42166", "vulnerability": {"vulnId": "CVE-2022-32409", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-15T03:32:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "fcd2e274-a260-477d-8579-39570ce42166", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-15T03:32:41+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-11-15T03:32:41+00:00", "first_seen_at": "2023-11-15T03:32:41+00:00"}, "scope": {"notes": "Affected: i3Geo / i3Geo | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-02-27: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-32409", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32409"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "i3Geo", "30d_avg": 0, "90d_avg": 0, "product": "i3Geo", "cisa_kev": "no", "connections": 1, "observation_date": "2023-02-27", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "21c4d428-f92c-489a-bcf0-a64d8e7d6eda", "vulnerability": {"vulnId": "CVE-2022-24288", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-15T03:31:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "21c4d428-f92c-489a-bcf0-a64d8e7d6eda", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-11-15T03:31:41+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-11-15T03:31:41+00:00", "first_seen_at": "2023-11-15T03:31:41+00:00"}, "scope": {"notes": "Affected: Apache / Airflow | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-02-27: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-24288", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24288"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Airflow", "cisa_kev": "no", "connections": 1, "observation_date": "2023-02-27", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "4428c0a7-ddcc-40e0-b8cd-dbe31a0f005d", "vulnerability": {"vulnId": "CVE-2020-13483", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-15T03:30:25+00:00"}, "gcve": {"gna": 1, "object_uuid": "4428c0a7-ddcc-40e0-b8cd-dbe31a0f005d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2023-11-15T03:30:25+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-11-15T03:30:25+00:00", "first_seen_at": "2023-11-15T03:30:25+00:00"}, "scope": {"notes": "Affected: Bitrix / Bitrix24 Web Application Firewall | Class: firewall | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-15: 602", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-13483", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13483"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 0, "vendor": "Bitrix", "30d_avg": 0, "90d_avg": 0, "product": "Bitrix24 Web Application Firewall", "cisa_kev": "no", "connections": 602, "observation_date": "2023-06-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}]}
{"uuid": "78ea8971-9304-4489-a26a-3ebdfb8f3001", "vulnerability": {"vulnId": "CVE-2022-3982", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-12T18:50:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "78ea8971-9304-4489-a26a-3ebdfb8f3001", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-12T18:50:47+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-11-12T18:50:47+00:00", "first_seen_at": "2023-11-12T18:50:47+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Booking Calendar plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-08-24: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-3982", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3982"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Booking Calendar plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2023-08-24", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "c75f263d-e467-4c89-8461-f8b2c0c3ed30", "vulnerability": {"vulnId": "CVE-2022-1950", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-12T14:33:20+00:00"}, "gcve": {"gna": 1, "object_uuid": "c75f263d-e467-4c89-8461-f8b2c0c3ed30", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-12T14:33:20+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-11-12T14:33:20+00:00", "first_seen_at": "2023-11-12T14:33:20+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Youzify plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-08-24: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-1950", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1950"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Youzify plugin", "cisa_kev": "no", "connections": 4, "observation_date": "2023-08-24", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "360a71f4-7e9c-471b-b069-a2c8b1520fc2", "vulnerability": {"vulnId": "CVE-2022-31474", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-12T12:00:39+00:00"}, "gcve": {"gna": 1, "object_uuid": "360a71f4-7e9c-471b-b069-a2c8b1520fc2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-11-12T12:00:39+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-11-12T12:00:39+00:00", "first_seen_at": "2023-11-12T12:00:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress BackupBuddy plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31474", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31474"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress BackupBuddy plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "c950e1e7-3635-4981-a945-4046a692eda7", "vulnerability": {"vulnId": "CVE-2023-0297", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-11-12T11:42:19+00:00"}, "gcve": {"gna": 1, "object_uuid": "c950e1e7-3635-4981-a945-4046a692eda7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-11-12T11:42:19+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-11-12T11:42:19+00:00", "first_seen_at": "2023-11-12T11:42:19+00:00"}, "scope": {"notes": "Affected: pyLoad / pyLoad | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-05-24: 228", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2023-0297", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0297"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "pyLoad", "30d_avg": 0, "90d_avg": 0, "product": "pyLoad", "cisa_kev": "no", "connections": 228, "observation_date": "2023-05-24", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "ed18ecdc-65e9-4d33-8aa2-106767b35a27", "vulnerability": {"vulnId": "CVE-2019-12988", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-31T04:59:13+00:00"}, "gcve": {"gna": 1, "object_uuid": "ed18ecdc-65e9-4d33-8aa2-106767b35a27", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-31T04:59:13+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-31T04:59:13+00:00", "first_seen_at": "2023-10-31T04:59:13+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix SD-WAN and NetScaler SD-WAN | Class: app-delivery-controller | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-19: 17", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-12988", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12988"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 1, "90d_avg": 0, "product": "Citrix SD-WAN and NetScaler SD-WAN", "cisa_kev": "no", "connections": 17, "observation_date": "2023-06-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "bc64bc47-5865-48a1-ab28-b41f86f52766", "vulnerability": {"vulnId": "CVE-UNASSIGNED-2022-RUIJIE-RCE-01", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-25T12:04:46+00:00"}, "gcve": {"gna": 1, "object_uuid": "bc64bc47-5865-48a1-ab28-b41f86f52766", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-25T12:04:46+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-25T12:04:46+00:00", "first_seen_at": "2023-10-25T12:04:46+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / unknown | Class: unknown | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-17: 14", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "unknown", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "unknown", "cisa_kev": "no", "connections": 14, "observation_date": "2023-03-17", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "3fb78a57-a1f4-42b3-b12b-5be5c195612e", "vulnerability": {"vulnId": "EDB-46792", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-24T22:02:44+00:00"}, "gcve": {"gna": 1, "object_uuid": "3fb78a57-a1f4-42b3-b12b-5be5c195612e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-24T22:02:44+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-24T22:02:44+00:00", "first_seen_at": "2023-10-24T22:02:44+00:00"}, "scope": {"notes": "Affected: 5VTechnologies / Blue Angel Software Suite | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-26: 69", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-46792", "url": "https://www.exploit-db.com/exploits/46792"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "5VTechnologies", "30d_avg": 0, "90d_avg": 0, "product": "Blue Angel Software Suite", "cisa_kev": "no", "connections": 69, "observation_date": "2022-08-26", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2560e7e8-c734-4954-bdb5-daf2c709bd02", "vulnerability": {"vulnId": "CVE-2014-9727", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-24T14:11:10+00:00"}, "gcve": {"gna": 1, "object_uuid": "2560e7e8-c734-4954-bdb5-daf2c709bd02", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2023-10-24T14:11:10+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-24T14:11:10+00:00", "first_seen_at": "2023-10-24T14:11:10+00:00"}, "scope": {"notes": "Affected: AVM / Fritz!Box | Class: router | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-01-08: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-9727", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9727"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "AVM", "30d_avg": 0, "90d_avg": 0, "product": "Fritz!Box", "cisa_kev": "no", "connections": 2, "observation_date": "2023-01-08", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}]}
{"uuid": "b30b57ba-4519-4c50-bb94-847e39403dec", "vulnerability": {"vulnId": "CVE-2022-40734", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-24T09:14:36+00:00"}, "gcve": {"gna": 1, "object_uuid": "b30b57ba-4519-4c50-bb94-847e39403dec", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-24T09:14:36+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-24T09:14:36+00:00", "first_seen_at": "2023-10-24T09:14:36+00:00"}, "scope": {"notes": "Affected: UniSharp / Laravel Filemanager | Class: other-software | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-40734", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40734"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "UniSharp", "30d_avg": 0, "90d_avg": 0, "product": "Laravel Filemanager", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-15", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}]}
{"uuid": "b7f70913-4429-48c9-b37f-5154c48054f2", "vulnerability": {"vulnId": "EDB-49457", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-23T20:50:08+00:00"}, "gcve": {"gna": 1, "object_uuid": "b7f70913-4429-48c9-b37f-5154c48054f2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-23T20:50:08+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-23T20:50:08+00:00", "first_seen_at": "2023-10-23T20:50:08+00:00"}, "scope": {"notes": "Affected: Selea / Targa IP OCR-ANPR Camera | Class: video-system | IoT: no | In CISA KEV: no | Honeypot connections on 2023-02-28: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-49457", "url": "https://www.exploit-db.com/exploits/49457"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Selea", "30d_avg": 0, "90d_avg": 0, "product": "Targa IP OCR-ANPR Camera", "cisa_kev": "no", "connections": 2, "observation_date": "2023-02-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "10298af7-3dec-4eca-8af0-13c8eb689b20", "vulnerability": {"vulnId": "CVE-2016-5700", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-21T23:35:21+00:00"}, "gcve": {"gna": 1, "object_uuid": "10298af7-3dec-4eca-8af0-13c8eb689b20", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-21T23:35:21+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-21T23:35:21+00:00", "first_seen_at": "2023-10-21T23:35:21+00:00"}, "scope": {"notes": "Affected: F5 / BIG-IP | Class: app-delivery-controller | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-21: 722", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2016-5700", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5700"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 0, "vendor": "F5", "30d_avg": 0, "90d_avg": 0, "product": "BIG-IP", "cisa_kev": "no", "connections": 722, "observation_date": "2022-08-21", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "6226706d-87aa-4a23-bc83-21efa362effa", "vulnerability": {"vulnId": "EDB-22127", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-21T19:52:02+00:00"}, "gcve": {"gna": 1, "object_uuid": "6226706d-87aa-4a23-bc83-21efa362effa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-21T19:52:02+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-21T19:52:02+00:00", "first_seen_at": "2023-10-21T19:52:02+00:00"}, "scope": {"notes": "Affected: DCP Portal / DCP Portal | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-20: 1096", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-22127", "url": "https://www.exploit-db.com/exploits/22127"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "DCP Portal", "30d_avg": 0, "90d_avg": 0, "product": "DCP Portal", "cisa_kev": "no", "connections": 1096, "observation_date": "2022-08-20", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "08fec6cd-60db-48e0-adee-f94db4ca16e6", "vulnerability": {"vulnId": "EDB-48857", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-20T13:52:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "08fec6cd-60db-48e0-adee-f94db4ca16e6", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-20T13:52:47+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-20T13:52:47+00:00", "first_seen_at": "2023-10-20T13:52:47+00:00"}, "scope": {"notes": "Affected: Karel / Karel IP Phone IP1211 | Class: other-software | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-06-15: 265", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-48857", "url": "https://www.exploit-db.com/exploits/48857"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Karel", "30d_avg": 0, "90d_avg": 0, "product": "Karel IP Phone IP1211", "cisa_kev": "no", "connections": 265, "observation_date": "2023-06-15", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a1db8ae7-2ad5-4b96-a2a9-a710607f9370", "vulnerability": {"vulnId": "CVE-2012-0297", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-20T11:51:16+00:00"}, "gcve": {"gna": 1, "object_uuid": "a1db8ae7-2ad5-4b96-a2a9-a710607f9370", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-20T11:51:16+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-20T11:51:16+00:00", "first_seen_at": "2023-10-20T11:51:16+00:00"}, "scope": {"notes": "Affected: Symantec / Symantec Web Gateway 5.0.2.8 | Class: firewall | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-29: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2012-0297", "url": "https://www.cve.org/CVERecord?id=CVE-2012-0297"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "firewall", "7d_avg": 1, "vendor": "Symantec", "30d_avg": 1, "90d_avg": 0, "product": "Symantec Web Gateway 5.0.2.8", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "9369775f-9803-480b-9c76-0a49125720c2", "vulnerability": {"vulnId": "CVE-2022-0482", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-19T10:59:02+00:00"}, "gcve": {"gna": 1, "object_uuid": "9369775f-9803-480b-9c76-0a49125720c2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2023-10-19T10:59:02+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-19T10:59:02+00:00", "first_seen_at": "2023-10-19T10:59:02+00:00"}, "scope": {"notes": "Affected: Easy!Appointments / Easy!Appointments | Class: other-software | Severity: Critical (CVSS 9.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-09-23: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-0482", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0482"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Easy!Appointments", "30d_avg": 0, "90d_avg": 0, "product": "Easy!Appointments", "cisa_kev": "no", "connections": 1, "observation_date": "2023-09-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}]}
{"uuid": "f8db98b9-7c27-4691-9806-51ed7b0fe76c", "vulnerability": {"vulnId": "CVE-2018-17283", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-19T08:51:53+00:00"}, "gcve": {"gna": 1, "object_uuid": "f8db98b9-7c27-4691-9806-51ed7b0fe76c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-19T08:51:53+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-19T08:51:53+00:00", "first_seen_at": "2023-10-19T08:51:53+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine OpManager | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-09-23: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-17283", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17283"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Zoho", "30d_avg": 1, "90d_avg": 0, "product": "ManageEngine OpManager", "cisa_kev": "no", "connections": 3, "observation_date": "2023-09-23", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "a46bcdcd-dd84-4e96-b9ef-7e3e67ea6dfa", "vulnerability": {"vulnId": "EDB-46881", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-19T00:13:36+00:00"}, "gcve": {"gna": 1, "object_uuid": "a46bcdcd-dd84-4e96-b9ef-7e3e67ea6dfa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-19T00:13:36+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-19T00:13:36+00:00", "first_seen_at": "2023-10-19T00:13:36+00:00"}, "scope": {"notes": "Affected: Moodle / Moodle JSmol plugin | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-46881", "url": "https://www.exploit-db.com/exploits/46881"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Moodle", "30d_avg": 0, "90d_avg": 0, "product": "Moodle JSmol plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2023-06-15", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "02fce8b7-9003-47b9-9975-640cb70f1aba", "vulnerability": {"vulnId": "CVE-2021-46442", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T18:19:51+00:00"}, "gcve": {"gna": 1, "object_uuid": "02fce8b7-9003-47b9-9975-640cb70f1aba", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T18:19:51+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-18T18:19:51+00:00", "first_seen_at": "2023-10-18T18:19:51+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-825 G1 | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-05-21: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-46442", "url": "https://www.cve.org/CVERecord?id=CVE-2021-46442"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-825 G1", "cisa_kev": "no", "connections": 12, "observation_date": "2023-05-21", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "535f4366-9634-4e65-ba96-29eaf5b12f81", "vulnerability": {"vulnId": "EDB-49456", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T18:19:24+00:00"}, "gcve": {"gna": 1, "object_uuid": "535f4366-9634-4e65-ba96-29eaf5b12f81", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-18T18:19:24+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-18T18:19:24+00:00", "first_seen_at": "2023-10-18T18:19:24+00:00"}, "scope": {"notes": "Affected: Selea / Targa IP OCR-ANPR Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-09-23: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-49456", "url": "https://www.exploit-db.com/exploits/49456"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "Selea", "30d_avg": 1, "90d_avg": 0, "product": "Targa IP OCR-ANPR Camera", "cisa_kev": "no", "connections": 3, "observation_date": "2023-09-23", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a131a731-60b0-46bb-8f6e-5b35dc3d5d1a", "vulnerability": {"vulnId": "CVE-2022-42953", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T18:18:07+00:00"}, "gcve": {"gna": 1, "object_uuid": "a131a731-60b0-46bb-8f6e-5b35dc3d5d1a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-18T18:18:07+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-18T18:18:07+00:00", "first_seen_at": "2023-10-18T18:18:07+00:00"}, "scope": {"notes": "Affected: ZKTeco / ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM | Class: security-management-platform | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-09-23: 2", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-42953", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42953"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "ZKTeco", "30d_avg": 1, "90d_avg": 0, "product": "ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM", "cisa_kev": "no", "connections": 2, "observation_date": "2023-09-23", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "dfba3003-8479-4f1e-a572-1c2e50299978", "vulnerability": {"vulnId": "CVE-2022-36804", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T18:17:40+00:00"}, "gcve": {"gna": 1, "object_uuid": "dfba3003-8479-4f1e-a572-1c2e50299978", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2023-10-18T18:17:40+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-18T18:17:40+00:00", "first_seen_at": "2023-10-18T18:17:40+00:00"}, "scope": {"notes": "Affected: Atlassian / Bitbucket | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-01-19: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-36804", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36804"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 0, "product": "Bitbucket", "cisa_kev": "yes", "connections": 3, "observation_date": "2023-01-19", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}]}
{"uuid": "977ddb0a-429f-4001-89bc-ea4b88012d81", "vulnerability": {"vulnId": "CVE-2017-18046", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T16:26:11+00:00"}, "gcve": {"gna": 1, "object_uuid": "977ddb0a-429f-4001-89bc-ea4b88012d81", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-18T16:26:11+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-18T16:26:11+00:00", "first_seen_at": "2023-10-18T16:26:11+00:00"}, "scope": {"notes": "Affected: Dasan / Dasan GPON ONT WiFi Router H640X | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-27: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-18046", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18046"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Dasan", "30d_avg": 0, "90d_avg": 0, "product": "Dasan GPON ONT WiFi Router H640X", "cisa_kev": "no", "connections": 5, "observation_date": "2022-08-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f4af4fdf-81b0-494a-98bf-95a557b860ab", "vulnerability": {"vulnId": "CVE-2021-43798", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T16:23:19+00:00"}, "gcve": {"gna": 1, "object_uuid": "f4af4fdf-81b0-494a-98bf-95a557b860ab", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-18T16:23:19+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-18T16:23:19+00:00", "first_seen_at": "2023-10-18T16:23:19+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-06-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-43798", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43798"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Grafana", "30d_avg": 0, "90d_avg": 0, "product": "Grafana", "cisa_kev": "no", "connections": 1, "observation_date": "2023-06-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "0b24db8b-a8dc-4de3-ac5f-2c049d30e233", "vulnerability": {"vulnId": "EDB-40500", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-18T03:34:01+00:00"}, "gcve": {"gna": 1, "object_uuid": "0b24db8b-a8dc-4de3-ac5f-2c049d30e233", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-18T03:34:01+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-18T03:34:01+00:00", "first_seen_at": "2023-10-18T03:34:01+00:00"}, "scope": {"notes": "Affected: AVTECH / AVTECH IP camera, NVR, DVR products | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-27: 156", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-40500", "url": "https://www.exploit-db.com/exploits/40500"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "AVTECH", "30d_avg": 0, "90d_avg": 0, "product": "AVTECH IP camera, NVR, DVR products", "cisa_kev": "no", "connections": 156, "observation_date": "2022-08-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "62cd49ff-7dab-43e0-879b-0a0ee1908d14", "vulnerability": {"vulnId": "CNVD-2021-01627", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-17T22:28:13+00:00"}, "gcve": {"gna": 1, "object_uuid": "62cd49ff-7dab-43e0-879b-0a0ee1908d14", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-17T22:28:13+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-17T22:28:13+00:00", "first_seen_at": "2023-10-17T22:28:13+00:00"}, "scope": {"notes": "Affected: Zhiyuan / Zhiyuan OA | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-26: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Zhiyuan", "30d_avg": 1, "90d_avg": 0, "product": "Zhiyuan OA", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-26", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "78f5676b-e9fb-4677-aaf3-240da91541ff", "vulnerability": {"vulnId": "CVE-2017-7876", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-16T10:27:51+00:00"}, "gcve": {"gna": 1, "object_uuid": "78f5676b-e9fb-4677-aaf3-240da91541ff", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-16T10:27:51+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-16T10:27:51+00:00", "first_seen_at": "2023-10-16T10:27:51+00:00"}, "scope": {"notes": "Affected: QNAP / QNAP QTS | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-09-23: 946", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-7876", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7876"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "QNAP", "30d_avg": 0, "90d_avg": 0, "product": "QNAP QTS", "cisa_kev": "no", "connections": 946, "observation_date": "2023-09-23", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "616e9bbd-1046-4edc-a8c6-c5984b2754ae", "vulnerability": {"vulnId": "CVE-2018-20062", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-15T04:27:47+00:00"}, "gcve": {"gna": 1, "object_uuid": "616e9bbd-1046-4edc-a8c6-c5984b2754ae", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-15T04:27:47+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-15T04:27:47+00:00", "first_seen_at": "2023-10-15T04:27:47+00:00"}, "scope": {"notes": "Affected: TopThink / ThinkPHP5 | Class: web-app-framework | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-28: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2018-20062", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20062"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "TopThink", "30d_avg": 0, "90d_avg": 0, "product": "ThinkPHP5", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "af711038-35fc-456e-88e5-72554b19cfaa", "vulnerability": {"vulnId": "CVE-2019-9082", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-15T04:27:45+00:00"}, "gcve": {"gna": 1, "object_uuid": "af711038-35fc-456e-88e5-72554b19cfaa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-15T04:27:45+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-15T04:27:45+00:00", "first_seen_at": "2023-10-15T04:27:45+00:00"}, "scope": {"notes": "Affected: TopThink / ThinkPHP5 | Class: web-app-framework | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-28: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-9082", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9082"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "TopThink", "30d_avg": 0, "90d_avg": 0, "product": "ThinkPHP5", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "b3955383-3a42-422e-99b3-19ba76d6a92e", "vulnerability": {"vulnId": "CVE-2014-3120", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-15T04:27:42+00:00"}, "gcve": {"gna": 1, "object_uuid": "b3955383-3a42-422e-99b3-19ba76d6a92e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-15T04:27:42+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-15T04:27:42+00:00", "first_seen_at": "2023-10-15T04:27:42+00:00"}, "scope": {"notes": "Affected: Elastic / Elasticsearch | Class: database | IoT: no | In CISA KEV: yes | Honeypot connections on 2022-08-28: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2014-3120", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3120"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 1, "vendor": "Elastic", "30d_avg": 1, "90d_avg": 0, "product": "Elasticsearch", "cisa_kev": "yes", "connections": 1, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "05a4eb33-7961-4868-a569-180aeae34a0a", "vulnerability": {"vulnId": "CNVD-2020-46552", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T22:50:39+00:00"}, "gcve": {"gna": 1, "object_uuid": "05a4eb33-7961-4868-a569-180aeae34a0a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T22:50:39+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T22:50:39+00:00", "first_seen_at": "2023-10-14T22:50:39+00:00"}, "scope": {"notes": "Affected: Sangfor / Sangfor EDR | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-27: 30", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "Sangfor", "30d_avg": 1, "90d_avg": 0, "product": "Sangfor EDR", "cisa_kev": "no", "connections": 30, "observation_date": "2022-08-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "38da8f85-bb02-4be1-85fb-378e980285c8", "vulnerability": {"vulnId": "CVE-UNASSIGNED-2020-SAMSUNG-WLAN-AP-RCE-01", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T22:50:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "38da8f85-bb02-4be1-85fb-378e980285c8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T22:50:14+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T22:50:14+00:00", "first_seen_at": "2023-10-14T22:50:14+00:00"}, "scope": {"notes": "Affected: Samsung / WLAN AP WEA453e | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-25: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 3, "vendor": "Samsung", "30d_avg": 1, "90d_avg": 0, "product": "WLAN AP WEA453e", "cisa_kev": "no", "connections": 5, "observation_date": "2022-08-25", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "12107853-e1f8-4031-84ea-c8105ed20f02", "vulnerability": {"vulnId": "CNVD-2021-49564", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T22:37:55+00:00"}, "gcve": {"gna": 1, "object_uuid": "12107853-e1f8-4031-84ea-c8105ed20f02", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T22:37:55+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T22:37:55+00:00", "first_seen_at": "2023-10-14T22:37:55+00:00"}, "scope": {"notes": "Affected: TamronOS / TamronOS IPTV/VOD | Class: other-software | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-03-16: 84", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "TamronOS", "30d_avg": 0, "90d_avg": 7, "product": "TamronOS IPTV/VOD", "cisa_kev": "no", "connections": 84, "observation_date": "2023-03-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "bd110aa0-5c1c-4ded-96d5-1169676daf2f", "vulnerability": {"vulnId": "EDB-47204", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T22:34:13+00:00"}, "gcve": {"gna": 1, "object_uuid": "bd110aa0-5c1c-4ded-96d5-1169676daf2f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T22:34:13+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T22:34:13+00:00", "first_seen_at": "2023-10-14T22:34:13+00:00"}, "scope": {"notes": "Affected: sar2html / sar2html | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2023-01-20: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-47204", "url": "https://www.exploit-db.com/exploits/47204"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "sar2html", "30d_avg": 0, "90d_avg": 0, "product": "sar2html", "cisa_kev": "no", "connections": 1, "observation_date": "2023-01-20", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "13a18486-d68d-4181-af0f-73999a669770", "vulnerability": {"vulnId": "EDB-49955", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T22:27:00+00:00"}, "gcve": {"gna": 1, "object_uuid": "13a18486-d68d-4181-af0f-73999a669770", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T22:27:00+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T22:27:00+00:00", "first_seen_at": "2023-10-14T22:27:00+00:00"}, "scope": {"notes": "Affected: OptiLink / ONT1GEW | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-27: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-49955", "url": "https://www.exploit-db.com/exploits/49955"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "OptiLink", "30d_avg": 0, "90d_avg": 0, "product": "ONT1GEW", "cisa_kev": "no", "connections": 12, "observation_date": "2022-08-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "98553c66-c0b0-453f-8325-37efb35aaa5b", "vulnerability": {"vulnId": "CVE-UNASSIGNED-2022-HIKVISION-MANAGEMENT-PLATFORM-RCE-01", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T21:42:19+00:00"}, "gcve": {"gna": 1, "object_uuid": "98553c66-c0b0-453f-8325-37efb35aaa5b", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T21:42:19+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T21:42:19+00:00", "first_seen_at": "2023-10-14T21:42:19+00:00"}, "scope": {"notes": "Affected: Hikvision / Management-Platform | Class: device-management-platform | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-02-10: 8", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Management-Platform", "cisa_kev": "no", "connections": 8, "observation_date": "2023-02-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "446bf6db-0356-4649-a6a1-c7683dc5f22e", "vulnerability": {"vulnId": "CVE-2022-21587", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T18:33:52+00:00"}, "gcve": {"gna": 1, "object_uuid": "446bf6db-0356-4649-a6a1-c7683dc5f22e", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T18:33:52+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T18:33:52+00:00", "first_seen_at": "2023-10-14T18:33:52+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle E-Business Suite (Oracle Web Applications Desktop Integrator) | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2023-02-28: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-21587", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21587"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 1, "90d_avg": 0, "product": "Oracle E-Business Suite (Oracle Web Applications Desktop Integrator)", "cisa_kev": "yes", "connections": 4, "observation_date": "2023-02-28", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "a8987204-17d4-4edb-bf74-d28321b8e3cf", "vulnerability": {"vulnId": "CVE-2020-15227", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T15:50:46+00:00"}, "gcve": {"gna": 1, "object_uuid": "a8987204-17d4-4edb-bf74-d28321b8e3cf", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-14T15:50:46+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T15:50:46+00:00", "first_seen_at": "2023-10-14T15:50:46+00:00"}, "scope": {"notes": "Affected: Nette / Nette | Class: web-app-framework | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-15: 3", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-15227", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15227"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Nette", "30d_avg": 0, "90d_avg": 1, "product": "Nette", "cisa_kev": "no", "connections": 3, "observation_date": "2023-03-15", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "d427f850-ca73-47b1-a197-076356bb3659", "vulnerability": {"vulnId": "EDB-49596", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T14:56:09+00:00"}, "gcve": {"gna": 1, "object_uuid": "d427f850-ca73-47b1-a197-076356bb3659", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:56:09+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T14:56:09+00:00", "first_seen_at": "2023-10-14T14:56:09+00:00"}, "scope": {"notes": "Affected: skittles / Simple Employee Records System 1.0 | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-29: 12", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-49596", "url": "https://www.exploit-db.com/exploits/49596"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "skittles", "30d_avg": 0, "90d_avg": 0, "product": "Simple Employee Records System 1.0", "cisa_kev": "no", "connections": 12, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "81b01aee-854f-4d4f-a80d-755da9f208d4", "vulnerability": {"vulnId": "CVE-2019-16932", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T14:56:06+00:00"}, "gcve": {"gna": 1, "object_uuid": "81b01aee-854f-4d4f-a80d-755da9f208d4", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2023-10-14T14:56:06+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T14:56:06+00:00", "first_seen_at": "2023-10-14T14:56:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Visualizer plugin (by Themeisle) | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2022-07-16: 6", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-16932", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16932"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Visualizer plugin (by Themeisle)", "cisa_kev": "no", "connections": 6, "observation_date": "2022-07-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "7c128b52-bb7b-4904-8fa9-4662e4223722", "vulnerability": {"vulnId": "EDB-40735", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T14:55:25+00:00"}, "gcve": {"gna": 1, "object_uuid": "7c128b52-bb7b-4904-8fa9-4662e4223722", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T14:55:25+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-14T14:55:25+00:00", "first_seen_at": "2023-10-14T14:55:25+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2730U/2750U/2750E | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-06-15: 5", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-40735", "url": "https://www.exploit-db.com/exploits/40735"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DSL-2730U/2750U/2750E", "cisa_kev": "no", "connections": 5, "observation_date": "2023-06-15", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "64f5e9eb-8832-4ada-ad56-e69af5a00e3d", "vulnerability": {"vulnId": "CVE-2022-31793", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T14:42:13+00:00"}, "gcve": {"gna": 1, "object_uuid": "64f5e9eb-8832-4ada-ad56-e69af5a00e3d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T14:42:13+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T14:42:13+00:00", "first_seen_at": "2023-10-14T14:42:13+00:00"}, "scope": {"notes": "Affected: Arris / Arris NVG443, NVG599, NVG589, NVG510 devices and Arris-derived BGW210, BGW320 devices | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-03-01: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-31793", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Arris", "30d_avg": 0, "90d_avg": 0, "product": "Arris NVG443, NVG599, NVG589, NVG510 devices and Arris-derived BGW210, BGW320 devices", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "1e019033-82b8-43dc-b006-b9dee0ddc0d8", "vulnerability": {"vulnId": "CNVD-2022-42853", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T13:53:16+00:00"}, "gcve": {"gna": 1, "object_uuid": "1e019033-82b8-43dc-b006-b9dee0ddc0d8", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T13:53:16+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T13:53:16+00:00", "first_seen_at": "2023-10-14T13:53:16+00:00"}, "scope": {"notes": "Affected: Qingdao Easysoft / ZenTao | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-15: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Qingdao Easysoft", "30d_avg": 0, "90d_avg": 0, "product": "ZenTao", "cisa_kev": "no", "connections": 1, "observation_date": "2023-03-15", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "da9dfb3d-1712-4941-8114-ffd60a28f73c", "vulnerability": {"vulnId": "CVE-2015-8562", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T13:49:36+00:00"}, "gcve": {"gna": 1, "object_uuid": "da9dfb3d-1712-4941-8114-ffd60a28f73c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-14T13:49:36+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T13:49:36+00:00", "first_seen_at": "2023-10-14T13:49:36+00:00"}, "scope": {"notes": "Affected: Open Source Matters, Inc/Joomla community / Joomla | Class: cms | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-29: 27", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2015-8562", "url": "https://www.cve.org/CVERecord?id=CVE-2015-8562"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 2, "vendor": "Open Source Matters, Inc/Joomla community", "30d_avg": 3, "90d_avg": 2, "product": "Joomla", "cisa_kev": "no", "connections": 27, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "dea6508f-2af2-4f92-972a-8c9d819f605a", "vulnerability": {"vulnId": "CNVD-2021-09650", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T13:03:49+00:00"}, "gcve": {"gna": 1, "object_uuid": "dea6508f-2af2-4f92-972a-8c9d819f605a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T13:03:49+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T13:03:49+00:00", "first_seen_at": "2023-10-14T13:03:49+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / NBR | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-25: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Ruijie Networks", "30d_avg": 1, "90d_avg": 0, "product": "NBR", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-25", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "f9a19282-62c9-44c7-b048-18861d057ff9", "vulnerability": {"vulnId": "CNVD-2021-30167", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T13:03:35+00:00"}, "gcve": {"gna": 1, "object_uuid": "f9a19282-62c9-44c7-b048-18861d057ff9", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T13:03:35+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-14T13:03:35+00:00", "first_seen_at": "2023-10-14T13:03:35+00:00"}, "scope": {"notes": "Affected: Yonyou / NC BeanShell | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2022-08-28: 28", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Yonyou", "30d_avg": 0, "90d_avg": 0, "product": "NC BeanShell", "cisa_kev": "no", "connections": 28, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e6517e24-b941-4f21-b78b-d5e147929595", "vulnerability": {"vulnId": "SSV-89107", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-14T13:03:29+00:00"}, "gcve": {"gna": 1, "object_uuid": "e6517e24-b941-4f21-b78b-d5e147929595", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-14T13:03:29+00:00", "recorded_at": "2026-06-30T15:27:43+00:00", "last_seen_at": "2023-10-14T13:03:29+00:00", "first_seen_at": "2023-10-14T13:03:29+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / Ruijie NBR routers | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2023-03-16: 83", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "Ruijie NBR routers", "cisa_kev": "no", "connections": 83, "observation_date": "2023-03-16", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e167dbc5-0edc-4780-9756-89a552335ac7", "vulnerability": {"vulnId": "CVE-2017-16959", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T19:00:18+00:00"}, "gcve": {"gna": 1, "object_uuid": "e167dbc5-0edc-4780-9756-89a552335ac7", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2023-10-13T19:00:18+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T19:00:18+00:00", "first_seen_at": "2023-10-13T19:00:18+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link multiple devices | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-27: 4", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2017-16959", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16959"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "TP-Link", "30d_avg": 1, "90d_avg": 0, "product": "TP-Link multiple devices", "cisa_kev": "no", "connections": 4, "observation_date": "2022-08-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "2a3f602e-b5c3-44b3-b430-f2a2209cf98f", "vulnerability": {"vulnId": "CVE-2021-35327", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T18:44:14+00:00"}, "gcve": {"gna": 1, "object_uuid": "2a3f602e-b5c3-44b3-b430-f2a2209cf98f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T18:44:14+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T18:44:14+00:00", "first_seen_at": "2023-10-13T18:44:14+00:00"}, "scope": {"notes": "Affected: Totolink / A720R | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-28: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2021-35327", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35327"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 1, "90d_avg": 0, "product": "A720R", "cisa_kev": "no", "connections": 1, "observation_date": "2022-08-28", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "7a5b5786-b418-4a38-b09b-03ba93dca08c", "vulnerability": {"vulnId": "CVE-UNASSIGNED-2020-ZYXEL-CPE-COMMAND-INJECTION-RCE-01", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T17:18:45+00:00"}, "gcve": {"gna": 1, "object_uuid": "7a5b5786-b418-4a38-b09b-03ba93dca08c", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T17:18:45+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2023-10-13T17:18:45+00:00", "first_seen_at": "2023-10-13T17:18:45+00:00"}, "scope": {"notes": "Affected: Zyxel / Multiple CPE | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-06-25: 1", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Multiple CPE", "cisa_kev": "no", "connections": 1, "observation_date": "2023-06-25", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "3de2a51d-c920-4f06-9659-437ec3ba2241", "vulnerability": {"vulnId": "EDB-39596", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T17:16:33+00:00"}, "gcve": {"gna": 1, "object_uuid": "3de2a51d-c920-4f06-9659-437ec3ba2241", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T17:16:33+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T17:16:33+00:00", "first_seen_at": "2023-10-13T17:16:33+00:00"}, "scope": {"notes": "Affected: Shenzhen TVT / CCTV-DVR (rebranded by multiple vendors) | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-29: 80", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-39596", "url": "https://www.exploit-db.com/exploits/39596"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "78", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 104, "vendor": "Shenzhen TVT", "30d_avg": 103, "90d_avg": 69, "product": "CCTV-DVR (rebranded by multiple vendors)", "cisa_kev": "no", "connections": 80, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "e671293c-ed0d-44ab-bdef-f3393fbef112", "vulnerability": {"vulnId": "CVE-2020-14883", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:31:17+00:00"}, "gcve": {"gna": 1, "object_uuid": "e671293c-ed0d-44ab-bdef-f3393fbef112", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2023-10-13T16:31:17+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T16:31:17+00:00", "first_seen_at": "2023-10-13T16:31:17+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle Weblogic Server | Class: app-server | IoT: no | In CISA KEV: yes | Honeypot connections on 2022-08-29: 52", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2020-14883", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14883"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 3, "vendor": "Oracle", "30d_avg": 4, "90d_avg": 2, "product": "Oracle Weblogic Server", "cisa_kev": "yes", "connections": 52, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "8306de6d-e979-4d3e-93c1-d87b18f2da8a", "vulnerability": {"vulnId": "CVE-2022-25075", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:23:23+00:00"}, "gcve": {"gna": 1, "object_uuid": "8306de6d-e979-4d3e-93c1-d87b18f2da8a", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2023-10-13T16:23:23+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-13T16:23:23+00:00", "first_seen_at": "2023-10-13T16:23:23+00:00"}, "scope": {"notes": "Affected: Totolink / A3100R, A810R, A830R, A860R, A950RG, A3100R, T6, and T10 routers | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-10-03: 117", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2022-25075", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25075"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "15", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 14, "vendor": "Totolink", "30d_avg": 6, "90d_avg": 2, "product": "A3100R, A810R, A830R, A860R, A950RG, A3100R, T6, and T10 routers", "cisa_kev": "no", "connections": 117, "observation_date": "2023-10-03", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}]}
{"uuid": "fe56f3c7-fa5e-4519-9d5f-90ebd9d93ac2", "vulnerability": {"vulnId": "CVE-2019-19356", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:22:22+00:00"}, "gcve": {"gna": 1, "object_uuid": "fe56f3c7-fa5e-4519-9d5f-90ebd9d93ac2", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2023-10-13T16:22:22+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2023-10-13T16:22:22+00:00", "first_seen_at": "2023-10-13T16:22:22+00:00"}, "scope": {"notes": "Affected: netis / netis WF2419 | Class: router | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2023-10-03: 95", "asset_exposure": ["internet-facing"]}, "references": [{"id": "CVE-2019-19356", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "11", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 10, "vendor": "netis", "30d_avg": 4, "90d_avg": 1, "product": "netis WF2419", "cisa_kev": "yes", "connections": 95, "observation_date": "2023-10-03", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}]}
{"uuid": "da3b6f71-585f-4e6a-84ba-cd4efa3ee2fa", "vulnerability": {"vulnId": "EDB-25978", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:12:41+00:00"}, "gcve": {"gna": 1, "object_uuid": "da3b6f71-585f-4e6a-84ba-cd4efa3ee2fa", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:12:41+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T16:12:41+00:00", "first_seen_at": "2023-10-13T16:12:41+00:00"}, "scope": {"notes": "Affected: Netgear / Netgear DGN1000 | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-29: 179", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-25978", "url": "https://www.exploit-db.com/exploits/25978"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "174", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 205, "vendor": "Netgear", "30d_avg": 207, "90d_avg": 146, "product": "Netgear DGN1000", "cisa_kev": "no", "connections": 179, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "a02f903e-edd2-42ad-bee4-6ff26276893f", "vulnerability": {"vulnId": "OPENVAS-1361412562310107187", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:12:08+00:00"}, "gcve": {"gna": 1, "object_uuid": "a02f903e-edd2-42ad-bee4-6ff26276893f", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:12:08+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T16:12:08+00:00", "first_seen_at": "2023-10-13T16:12:08+00:00"}, "scope": {"notes": "Affected: Vacron / Network Video Recorder (NVR) | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-29: 42", "asset_exposure": ["internet-facing"]}, "references": [{"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "41", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 39, "vendor": "Vacron", "30d_avg": 43, "90d_avg": 28, "product": "Network Video Recorder (NVR)", "cisa_kev": "no", "connections": 42, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}
{"uuid": "c4bf9e8a-7eb0-410a-919f-b54ff909387d", "vulnerability": {"vulnId": "EDB-31683", "altId": []}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2023-10-13T16:05:25+00:00"}, "gcve": {"gna": 1, "object_uuid": "c4bf9e8a-7eb0-410a-919f-b54ff909387d", "origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8"}, "characteristics": {}, "timestamps": {"asserted_at": "2023-10-13T16:05:25+00:00", "recorded_at": "2026-06-30T15:41:17+00:00", "last_seen_at": "2023-10-13T16:05:25+00:00", "first_seen_at": "2023-10-13T16:05:25+00:00"}, "scope": {"notes": "Affected: Linksys / Linksys E-Series | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2022-08-29: 10", "asset_exposure": ["internet-facing"]}, "references": [{"id": "EDB-31683", "url": "https://www.exploit-db.com/exploits/31683"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}], "evidence": [{"source": "shadowserver", "type": "honeypot", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 7, "vendor": "Linksys", "30d_avg": 9, "90d_avg": 13, "product": "Linksys E-Series", "cisa_kev": "no", "connections": 10, "observation_date": "2022-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}]}