{"metadata": {"count": 1245, "page": 1, "per_page": 100}, "data": [{"uuid": "ed62bca8-9e0e-49c1-ae3a-cb8ff2fc0f9a", "vulnerability": {"vulnId": "CVE-2026-4631", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ed62bca8-9e0e-49c1-ae3a-cb8ff2fc0f9a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T12:18:53+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-08T12:18:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T12:18:53+00:00", "first_seen_at": "2026-07-08T12:18:53+00:00"}, "scope": {"notes": "Affected: Cockpit / Cockpit | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Cockpit", "30d_avg": 0, "90d_avg": 0, "product": "Cockpit", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-4631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4631"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fd2117df-8e49-494d-98bb-d3e9ee76a484", "vulnerability": {"vulnId": "CVE-2023-39361", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "fd2117df-8e49-494d-98bb-d3e9ee76a484"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-06T22:07:16+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-07-06T22:07:16+00:00"}, "scope": {"notes": "Affected: Cacti / Cacti | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 0, "vendor": "Cacti", "30d_avg": 0, "90d_avg": 0, "product": "Cacti", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-39361", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39361"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ca26b41a-f044-46bd-9a20-65a88b4668df", "vulnerability": {"vulnId": "CVE-2022-50992", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ca26b41a-f044-46bd-9a20-65a88b4668df"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T18:39:49+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-07-06T18:39:49+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T18:39:49+00:00", "first_seen_at": "2026-07-06T18:39:49+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 33", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 33, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2022-50992", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50992"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2a5ff222-f05b-40a6-a0cf-514901862678", "vulnerability": {"vulnId": "CVE-2026-34910", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2a5ff222-f05b-40a6-a0cf-514901862678"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-07-06T16:13:45+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-07-06T16:13:45+00:00"}, "scope": {"notes": "Affected: Ubiquiti / Ubiquiti UniFi | Class: router | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-08: 150", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Ubiquiti", "30d_avg": 0, "90d_avg": 0, "product": "Ubiquiti UniFi", "cisa_kev": "yes", "connections": 150, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-34910", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34910"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "49d6289e-1c06-4f60-9dcb-0349a7206080", "vulnerability": {"vulnId": "CVE-2026-1207", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "49d6289e-1c06-4f60-9dcb-0349a7206080"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T11:34:45+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:34:45+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T11:34:45+00:00", "first_seen_at": "2026-07-06T11:34:45+00:00"}, "scope": {"notes": "Affected: Django / Django RasterField | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Django", "30d_avg": 0, "90d_avg": 0, "product": "Django RasterField", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-1207", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1b26b62a-da76-499d-90ac-46ad2a554239", "vulnerability": {"vulnId": "CVE-2026-42271", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "1b26b62a-da76-499d-90ac-46ad2a554239"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:17:45+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-07-06T11:17:45+00:00"}, "scope": {"notes": "Affected: LiteLLM / LiteLLM | Class: ai-system | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 278", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "257", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 79, "vendor": "LiteLLM", "30d_avg": 18, "90d_avg": 6, "product": "LiteLLM", "cisa_kev": "yes", "connections": 278, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-42271", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42271"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b82e6d59-2cf9-44dc-8b8d-09ccd4f08699", "vulnerability": {"vulnId": "CVE-2026-1125", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b82e6d59-2cf9-44dc-8b8d-09ccd4f08699"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T12:35:18+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-02T12:35:18+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T12:35:18+00:00", "first_seen_at": "2026-07-02T12:35:18+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-02: 12", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1125", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1125"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "cc9a7416-c67e-4f8c-89a0-9f438d3d884a", "vulnerability": {"vulnId": "CVE-2017-12542", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "cc9a7416-c67e-4f8c-89a0-9f438d3d884a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-30T13:11:03+00:00", "recorded_at": "2026-07-03T01:00:01+00:00", "last_seen_at": "2026-07-01T00:00:00+00:00", "first_seen_at": "2026-06-30T13:11:03+00:00"}, "scope": {"notes": "Affected: HP / HP iLO 4 | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-01: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HP", "30d_avg": 0, "90d_avg": 0, "product": "HP iLO 4", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-01", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2017-12542", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12542"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d1683ee2-227b-4228-9226-d64a61d93fca", "vulnerability": {"vulnId": "CVE-2026-36356", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "d1683ee2-227b-4228-9226-d64a61d93fca"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-25T00:00:00+00:00"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2026-06-21T06:44:37+00:00", "recorded_at": "2026-06-30T15:47:38+00:00", "last_seen_at": "2026-06-25T00:00:00+00:00", "first_seen_at": "2026-06-21T06:44:37+00:00"}, "scope": {"notes": "Affected: MeiG / MeiG Smart FORGE_SLT711 | Class: router | Severity: Critical (CVSS 9.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-25: 31", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "MeiG", "30d_avg": 0, "90d_avg": 0, "product": "MeiG Smart FORGE_SLT711", "cisa_kev": "no", "connections": 31, "observation_date": "2026-06-25", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "36e24aa2-07e7-451d-90f5-968b387cebf9", "vulnerability": {"vulnId": "CVE-2026-10520", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "36e24aa2-07e7-451d-90f5-968b387cebf9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-10T17:11:12+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-06-10T17:11:12+00:00"}, "scope": {"notes": "Affected: Ivanti / Sentry | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 4, "vendor": "Ivanti", "30d_avg": 2, "90d_avg": 0, "product": "Sentry", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-10520", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9d46fb90-1d7c-4cb5-8731-ff8853bd4fb0", "vulnerability": {"vulnId": "CVE-2026-24423", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9d46fb90-1d7c-4cb5-8731-ff8853bd4fb0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-06-08T12:19:21+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-06-08T12:19:21+00:00"}, "scope": {"notes": "Affected: SmarterTools / SmarterMail | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "SmarterTools", "30d_avg": 0, "90d_avg": 0, "product": "SmarterMail", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-24423", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24423"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3109d1ed-1468-43be-8627-3441953ffa07", "vulnerability": {"vulnId": "CVE-2024-8522", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "3109d1ed-1468-43be-8627-3441953ffa07"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-06-08T12:12:59+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-06-08T12:12:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-8522", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8522"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b190c574-a61d-49ed-afb3-869ca84cb882", "vulnerability": {"vulnId": "CVE-2025-34033", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b190c574-a61d-49ed-afb3-869ca84cb882"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-27T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-06-07T19:06:22+00:00", "recorded_at": "2026-06-30T15:47:38+00:00", "last_seen_at": "2026-06-27T00:00:00+00:00", "first_seen_at": "2026-06-07T19:06:22+00:00"}, "scope": {"notes": "Affected: 5VTechnologies / Blue Angel Software Suite | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-27: 100", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "5VTechnologies", "30d_avg": 0, "90d_avg": 0, "product": "Blue Angel Software Suite", "cisa_kev": "no", "connections": 100, "observation_date": "2026-06-27", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34033", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34033"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "151cf4f8-0671-4796-a26a-c7c7b22473d1", "vulnerability": {"vulnId": "CVE-2020-9314", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "151cf4f8-0671-4796-a26a-c7c7b22473d1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "characteristics": {"severity": 48}, "timestamps": {"asserted_at": "2026-05-16T21:20:08+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-05-16T21:20:08+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle iPlanet Web Server | Class: web-server | Severity: Medium (CVSS 4.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle iPlanet Web Server", "cisa_kev": "no", "connections": 2, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 4.8, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2020-9314", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9ccf93e1-11e4-4d20-8e4c-ac7432f2c3b1", "vulnerability": {"vulnId": "CVE-2025-67303", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9ccf93e1-11e4-4d20-8e4c-ac7432f2c3b1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:51:35+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-16T15:51:35+00:00"}, "scope": {"notes": "Affected: Comfy Org / ComfyUI-Manager | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Comfy Org", "30d_avg": 7, "90d_avg": 3, "product": "ComfyUI-Manager", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-67303", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67303"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "adb7f1ae-7565-44ba-a323-ba33cd9d31fc", "vulnerability": {"vulnId": "CVE-2024-45309", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "adb7f1ae-7565-44ba-a323-ba33cd9d31fc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:14:18+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-16T15:14:18+00:00"}, "scope": {"notes": "Affected: OneDev / OneDev | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "OneDev", "30d_avg": 6, "90d_avg": 3, "product": "OneDev", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-45309", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45309"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3f1f1eaf-44e9-41d0-9b5f-eccdad1fe3a4", "vulnerability": {"vulnId": "CVE-2022-28290", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "3f1f1eaf-44e9-41d0-9b5f-eccdad1fe3a4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-05-16T10:01:07+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-16T10:01:07+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Country Selector plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 0, "product": "Wordpress Country Selector plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2022-28290", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28290"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "775fb1e1-01a5-48b8-885b-907b95e11c08", "vulnerability": {"vulnId": "CVE-2021-22054", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "775fb1e1-01a5-48b8-885b-907b95e11c08"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-15T15:16:56+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-15T15:16:56+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-15T15:16:56+00:00", "first_seen_at": "2026-05-15T15:16:56+00:00"}, "scope": {"notes": "Affected: Omnissa / Omnissa Workspace ONE UEM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-05-15: 6", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Omnissa", "30d_avg": 0, "90d_avg": 0, "product": "Omnissa Workspace ONE UEM", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-05-15", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-22054", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9ad1b587-1724-4787-b333-28f81b595efd", "vulnerability": {"vulnId": "CVE-2022-50993", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9ad1b587-1724-4787-b333-28f81b595efd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-05T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:44+00:00", "recorded_at": "2026-07-07T01:00:02+00:00", "last_seen_at": "2026-07-05T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:44+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-05: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 1, "90d_avg": 0, "product": "Weaver E-Office", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-05", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-50993", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50993"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "27abe1b2-b630-49aa-b503-c060bee611f6", "vulnerability": {"vulnId": "CVE-2025-71284", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "27abe1b2-b630-49aa-b503-c060bee611f6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:17+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:17+00:00"}, "scope": {"notes": "Affected: Synway Information Engineering / Synway SMG Gateway Management Software | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Synway Information Engineering", "30d_avg": 0, "90d_avg": 0, "product": "Synway SMG Gateway Management Software", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-71284", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71284"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b6cc24f9-665e-42b3-8715-3eb1b0d6dc72", "vulnerability": {"vulnId": "CVE-2023-2523", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b6cc24f9-665e-42b3-8715-3eb1b0d6dc72"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:12:02+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-05-13T13:12:02+00:00"}, "scope": {"notes": "Affected: Weaver / Weave E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weave E-Office", "cisa_kev": "no", "connections": 1, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-2523", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2523"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2c111d36-9f60-4dbf-863b-2308f9998f4d", "vulnerability": {"vulnId": "CVE-2026-41176", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2c111d36-9f60-4dbf-863b-2308f9998f4d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:00:00+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-13T13:00:00+00:00"}, "scope": {"notes": "Affected: Rclone / Rclone | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rclone", "30d_avg": 5, "90d_avg": 3, "product": "Rclone", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-41176", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41176"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8967e486-ec9b-4b3a-a500-4e8967e3137c", "vulnerability": {"vulnId": "CVE-2019-13396", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "8967e486-ec9b-4b3a-a500-4e8967e3137c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-11T14:26:48+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-05-11T14:26:48+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-11T14:26:48+00:00", "first_seen_at": "2026-05-11T14:26:48+00:00"}, "scope": {"notes": "Affected: FlightPath / FlightPath | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-11: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "FlightPath", "30d_avg": 0, "90d_avg": 0, "product": "FlightPath", "cisa_kev": "no", "connections": 2, "observation_date": "2026-05-11", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2019-13396", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13396"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f0b3bf29-958b-40ea-b29d-cff9118c4895", "vulnerability": {"vulnId": "CVE-2020-1956", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "f0b3bf29-958b-40ea-b29d-cff9118c4895"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-05-11T07:31:41+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-11T07:31:41+00:00"}, "scope": {"notes": "Affected: Apache / Apache Kylin | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 6, "90d_avg": 3, "product": "Apache Kylin", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2020-1956", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1956"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "81cf0ee7-9392-44fe-a343-c3d5f88cfead", "vulnerability": {"vulnId": "CVE-2025-34058", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "81cf0ee7-9392-44fe-a343-c3d5f88cfead"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-03T16:22:57+00:00"}, "timestamps": {"asserted_at": "2026-05-03T16:22:57+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-03T16:22:57+00:00", "first_seen_at": "2026-05-03T16:22:57+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision Streaming Media Management Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-03: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Hikvision Streaming Media Management Server", "cisa_kev": "no", "connections": 3, "observation_date": "2026-05-03", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34058", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34058"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "083ff118-06a1-4029-a752-d11f6d28116f", "vulnerability": {"vulnId": "CVE-2023-6266", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "083ff118-06a1-4029-a752-d11f6d28116f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T18:17:15+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-01T18:17:15+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Backup Migration plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 2, "90d_avg": 1, "product": "Wordpress Backup Migration plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-6266", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6266"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9ff865fb-de7f-456f-8e97-1bd5e9613f52", "vulnerability": {"vulnId": "CVE-2021-27358", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9ff865fb-de7f-456f-8e97-1bd5e9613f52"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T17:07:58+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-05-01T17:07:58+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 1, "vendor": "Grafana", "30d_avg": 3, "90d_avg": 2, "product": "Grafana", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-27358", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27358"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1962e632-5979-4757-ba05-01545a9aee7b", "vulnerability": {"vulnId": "CVE-2023-6909", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "1962e632-5979-4757-ba05-01545a9aee7b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-30T18:23:58+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-30T18:23:58+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "MLflow", "30d_avg": 24, "90d_avg": 14, "product": "MLflow", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-6909", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6909"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fc2bf820-a58d-4a5b-9b59-c01119b09188", "vulnerability": {"vulnId": "CVE-2022-4059", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "fc2bf820-a58d-4a5b-9b59-c01119b09188"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T15:35:33+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-30T15:35:33+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress AWP Classifieds plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 6, "90d_avg": 3, "product": "Wordpress AWP Classifieds plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-4059", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "163fb203-8a00-4bb8-8e99-49b545f0f8a2", "vulnerability": {"vulnId": "CVE-2026-41940", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "163fb203-8a00-4bb8-8e99-49b545f0f8a2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T13:55:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-30T13:55:53+00:00"}, "scope": {"notes": "Affected: cPanel / cPanel and WHM | Class: remote-access | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2568", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "169", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 160, "vendor": "cPanel", "30d_avg": 290, "90d_avg": 250, "product": "cPanel and WHM", "cisa_kev": "yes", "connections": 2568, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-41940", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41940"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "34ec8177-b8c1-444c-955f-7234284ca382", "vulnerability": {"vulnId": "CVE-2025-29635", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "34ec8177-b8c1-444c-955f-7234284ca382"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-03T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-04-27T01:02:53+00:00", "recorded_at": "2026-07-05T01:00:01+00:00", "last_seen_at": "2026-07-03T00:00:00+00:00", "first_seen_at": "2026-04-27T01:02:53+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-07-03: 26", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "yes", "connections": 26, "observation_date": "2026-07-03", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-29635", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29635"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f75d786c-dffd-4dd2-b9b7-b27d5f232b54", "vulnerability": {"vulnId": "CVE-2023-3793", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "f75d786c-dffd-4dd2-b9b7-b27d5f232b54"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-26T02:13:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-26T02:13:53+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 1, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-3793", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d912f242-62bf-4dc1-8f22-183da0d8e4b3", "vulnerability": {"vulnId": "CVE-2026-1340", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "d912f242-62bf-4dc1-8f22-183da0d8e4b3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-19T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-26T00:27:43+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-06-19T00:00:00+00:00", "first_seen_at": "2026-04-26T00:27:43+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-06-19: 11", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 0, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 0, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 11, "observation_date": "2026-06-19", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1340", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1340"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9f813fc5-06ca-40bc-bb53-6576a0d65770", "vulnerability": {"vulnId": "CVE-2026-34197", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "9f813fc5-06ca-40bc-bb53-6576a0d65770"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-04-24T16:01:56+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-24T16:01:56+00:00"}, "scope": {"notes": "Affected: Apache / ActiveMQ | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 5, "90d_avg": 3, "product": "ActiveMQ", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-34197", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34197"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "4df2d3ab-8145-4d6b-a9e7-fa45d374ab54", "vulnerability": {"vulnId": "CVE-2021-22017", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "4df2d3ab-8145-4d6b-a9e7-fa45d374ab54"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-04-21T12:54:50+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-21T12:54:50+00:00"}, "scope": {"notes": "Affected: VMware / vCenter Server | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "VMware", "30d_avg": 1, "90d_avg": 0, "product": "vCenter Server", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2021-22017", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22017"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "aa44165a-2482-471c-b371-77029ee4fd78", "vulnerability": {"vulnId": "CVE-2024-22927", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "aa44165a-2482-471c-b371-77029ee4fd78"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-06T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-04-21T11:16:38+00:00", "recorded_at": "2026-07-08T01:00:01+00:00", "last_seen_at": "2026-07-06T00:00:00+00:00", "first_seen_at": "2026-04-21T11:16:38+00:00"}, "scope": {"notes": "Affected: weng-xianhu / EyouCMS | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "weng-xianhu", "30d_avg": 0, "90d_avg": 0, "product": "EyouCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-06", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2024-22927", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22927"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1e78c2fe-ff21-478d-9875-d7fbf8883cd2", "vulnerability": {"vulnId": "CVE-2023-37999", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "1e78c2fe-ff21-478d-9875-d7fbf8883cd2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-18T03:38:57+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-18T03:38:57+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress HasThemes HT Mega | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 3, "product": "Wordpress HasThemes HT Mega", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-37999", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37999"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c555d607-a490-46e6-b81c-27005a7204c3", "vulnerability": {"vulnId": "CVE-2023-27351", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "c555d607-a490-46e6-b81c-27005a7204c3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-18T00:07:44+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-18T00:07:44+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut MF/NG | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "PaperCut", "30d_avg": 7, "90d_avg": 4, "product": "PaperCut MF/NG", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-27351", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27351"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "464b7f3d-0c16-4412-a9aa-0c295911257b", "vulnerability": {"vulnId": "CVE-2017-9506", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "464b7f3d-0c16-4412-a9aa-0c295911257b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-04-15T08:29:24+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-15T08:29:24+00:00"}, "scope": {"notes": "Affected: Atlassian / Atlassian OAuth Plugin | Class: security-management-platform | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 1, "vendor": "Atlassian", "30d_avg": 1, "90d_avg": 0, "product": "Atlassian OAuth Plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2017-9506", "url": "https://www.cve.org/CVERecord?id=CVE-2017-9506"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "00cb1b7c-1847-4d20-8dd5-dd1fd518c0c6", "vulnerability": {"vulnId": "CVE-2024-22768", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "00cb1b7c-1847-4d20-8dd5-dd1fd518c0c6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-12T22:07:42+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-12T22:07:42+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-04-12T22:07:42+00:00", "first_seen_at": "2026-04-12T22:07:42+00:00"}, "scope": {"notes": "Affected: Hitron Systems / Hitron Systems DVR | Class: video-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-04-12: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Hitron Systems", "30d_avg": 0, "90d_avg": 0, "product": "Hitron Systems DVR", "cisa_kev": "no", "connections": 1, "observation_date": "2026-04-12", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-22768", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22768"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a7dc7b4b-a2d5-4db8-bac9-a8d05d83d4f6", "vulnerability": {"vulnId": "CVE-2023-2806", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a7dc7b4b-a2d5-4db8-bac9-a8d05d83d4f6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-04-09T15:11:01+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-04-09T15:11:01+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver e-cology | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver e-cology", "cisa_kev": "no", "connections": 1, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-2806", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2806"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0d755cef-f714-43e7-9b68-f2d870bb6d08", "vulnerability": {"vulnId": "CVE-2025-1338", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "0d755cef-f714-43e7-9b68-f2d870bb6d08"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-04-09T04:17:32+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-09T04:17:32+00:00"}, "scope": {"notes": "Affected: NUUO / NUUO Camera | Class: video-system | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 1, "vendor": "NUUO", "30d_avg": 3, "90d_avg": 2, "product": "NUUO Camera", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-1338", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1338"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b68d25af-5148-439e-801d-b6d948ca6bae", "vulnerability": {"vulnId": "CVE-2026-1405", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "b68d25af-5148-439e-801d-b6d948ca6bae"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-06T18:37:12+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-06T18:37:12+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Slider Future plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 1, "product": "Wordpress Slider Future plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1405", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1405"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e604f905-b579-45fc-9723-c484a008b959", "vulnerability": {"vulnId": "CVE-2026-3965", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e604f905-b579-45fc-9723-c484a008b959"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-06T00:00:00+00:00"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-04-06T15:52:30+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-05-06T00:00:00+00:00", "first_seen_at": "2026-04-06T15:52:30+00:00"}, "scope": {"notes": "Affected: whyour / qinglong | Class: device-management-platform | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 4, "vendor": "whyour", "30d_avg": 2, "90d_avg": 0, "product": "qinglong", "cisa_kev": "no", "connections": 1, "observation_date": "2026-05-06", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2026-3965", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3965"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a254cf21-312f-4045-86b0-7b69f773d42d", "vulnerability": {"vulnId": "CVE-2023-39964", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a254cf21-312f-4045-86b0-7b69f773d42d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-16T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-06T15:15:06+00:00", "recorded_at": "2026-06-30T09:25:12+00:00", "last_seen_at": "2026-04-16T00:00:00+00:00", "first_seen_at": "2026-04-06T15:15:06+00:00"}, "scope": {"notes": "Affected: 1Panel / !Panel | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-04-16: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "1Panel", "30d_avg": 0, "90d_avg": 0, "product": "!Panel", "cisa_kev": "no", "connections": 1, "observation_date": "2026-04-16", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-39964", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39964"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "60ec08e2-667c-4cb0-b78c-ac4058db2559", "vulnerability": {"vulnId": "CVE-2026-21643", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "60ec08e2-667c-4cb0-b78c-ac4058db2559"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-04T23:51:07+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-04-04T23:51:07+00:00"}, "scope": {"notes": "Affected: Fortinet / FortiClientEMS | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 6", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 2, "vendor": "Fortinet", "30d_avg": 7, "90d_avg": 4, "product": "FortiClientEMS", "cisa_kev": "yes", "connections": 6, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-21643", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21643"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "bc09eed3-d39f-489c-a0f4-81e09ce314a5", "vulnerability": {"vulnId": "CVE-2018-0125", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "bc09eed3-d39f-489c-a0f4-81e09ce314a5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-04-02T18:11:50+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-02T18:11:50+00:00", "recorded_at": "2026-06-30T15:16:12+00:00", "last_seen_at": "2026-04-02T18:11:50+00:00", "first_seen_at": "2026-04-02T18:11:50+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco RV132W/RV134W | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2023-05-25: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco RV132W/RV134W", "cisa_kev": "yes", "connections": 2, "observation_date": "2023-05-25", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2018-0125", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0125"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ffd585cc-2e1d-4806-8fc5-72d77f5b945d", "vulnerability": {"vulnId": "CVE-2026-3055", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ffd585cc-2e1d-4806-8fc5-72d77f5b945d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-31T14:47:50+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-31T14:47:50+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix NetScaler ADC and NetScaler Gateway | Class: app-delivery-controller | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 8", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-delivery-controller", "7d_avg": 11, "vendor": "Citrix", "30d_avg": 20, "90d_avg": 29, "product": "Citrix NetScaler ADC and NetScaler Gateway", "cisa_kev": "yes", "connections": 8, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-3055", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3055"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f91b9f08-0785-47eb-8fc1-f6a6d214b79b", "vulnerability": {"vulnId": "CVE-2025-4322", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "f91b9f08-0785-47eb-8fc1-f6a6d214b79b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-29T01:13:46+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-29T01:13:46+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Motors theme | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 9", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "9", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 2, "90d_avg": 1, "product": "Wordpress Motors theme", "cisa_kev": "no", "connections": 9, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-4322", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4322"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "4dcf1ca1-afb9-4630-ad30-09a12f27c516", "vulnerability": {"vulnId": "CVE-2025-34152", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "4dcf1ca1-afb9-4630-ad30-09a12f27c516"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 94}, "timestamps": {"asserted_at": "2026-03-25T17:41:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-25T17:41:53+00:00"}, "scope": {"notes": "Affected: Shenzhen Aitemi / Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) | Class: router | Severity: Critical (CVSS 9.4) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Aitemi", "30d_avg": 2, "90d_avg": 1, "product": "Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.4, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-34152", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34152"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "85eb6859-05ad-49c3-a8dd-7b2bf31b681f", "vulnerability": {"vulnId": "CVE-2023-47253", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "85eb6859-05ad-49c3-a8dd-7b2bf31b681f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-24T19:42:39+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-24T19:42:39+00:00"}, "scope": {"notes": "Affected: Qualitor / Qualitor ITSM | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Qualitor", "30d_avg": 3, "90d_avg": 2, "product": "Qualitor ITSM", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-47253", "url": "https://www.cve.org/CVERecord?id=CVE-2023-47253"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "629ff7e3-8409-4a73-888a-2955d9b73451", "vulnerability": {"vulnId": "CVE-2021-44515", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "629ff7e3-8409-4a73-888a-2955d9b73451"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-24T04:43:07+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-24T04:43:07+00:00"}, "scope": {"notes": "Affected: Zoho / ManageEngine Desktop Central | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "Zoho", "30d_avg": 3, "90d_avg": 2, "product": "ManageEngine Desktop Central", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-44515", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44515"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "eaa3b0a6-4767-4fca-b0ab-ceb6763eddcd", "vulnerability": {"vulnId": "CVE-2025-32814", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "eaa3b0a6-4767-4fca-b0ab-ceb6763eddcd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-14T16:01:41+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-14T16:01:41+00:00"}, "scope": {"notes": "Affected: Infoblox / Infoblox NETMRI | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Infoblox", "30d_avg": 2, "90d_avg": 1, "product": "Infoblox NETMRI", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-32814", "url": "https://www.cve.org/CVERecord?id=CVE-2025-32814"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "68c84b40-0817-4ba4-8223-b2429acc5f7c", "vulnerability": {"vulnId": "CVE-2026-21902", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "68c84b40-0817-4ba4-8223-b2429acc5f7c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-20T00:00:00+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-14T11:28:11+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-20T00:00:00+00:00", "first_seen_at": "2026-03-14T11:28:11+00:00"}, "scope": {"notes": "Affected: Juniper / Junos OS Evolved on PTX Series | Class: embedded-system | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-03-20: 45", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 1, "vendor": "Juniper", "30d_avg": 0, "90d_avg": 0, "product": "Junos OS Evolved on PTX Series", "cisa_kev": "no", "connections": 45, "observation_date": "2026-03-20", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-21902", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21902"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "4475dd4b-501a-48b7-a71f-2bd9dc6bacdd", "vulnerability": {"vulnId": "CVE-2019-12314", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "4475dd4b-501a-48b7-a71f-2bd9dc6bacdd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-12T18:48:37+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-03-12T18:48:37+00:00"}, "scope": {"notes": "Affected: Deltek / Deltek Maconomy | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Deltek", "30d_avg": 4, "90d_avg": 1, "product": "Deltek Maconomy", "cisa_kev": "no", "connections": 1, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-12314", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c543b95f-2c31-4c83-b11c-bb40fd4a3666", "vulnerability": {"vulnId": "CVE-2018-25114", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "c543b95f-2c31-4c83-b11c-bb40fd4a3666"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-12T16:28:08+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-12T16:28:08+00:00"}, "scope": {"notes": "Affected: osCommerce / osCommerce Online Merchant | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "osCommerce", "30d_avg": 6, "90d_avg": 4, "product": "osCommerce Online Merchant", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2018-25114", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25114"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ca72b103-42bc-47ae-8ca6-33afe0f0dd49", "vulnerability": {"vulnId": "CVE-2020-4427", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ca72b103-42bc-47ae-8ca6-33afe0f0dd49"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-12T11:56:35+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-12T11:56:35+00:00"}, "scope": {"notes": "Affected: IBM / IBM Data Risk Manager | Class: security-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 140", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "6", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 4, "vendor": "IBM", "30d_avg": 4, "90d_avg": 3, "product": "IBM Data Risk Manager", "cisa_kev": "yes", "connections": 140, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2020-4427", "url": "https://www.cve.org/CVERecord?id=CVE-2020-4427"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ceb03577-7cc6-4c91-bf09-ec47f5c64748", "vulnerability": {"vulnId": "CVE-2024-4841", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ceb03577-7cc6-4c91-bf09-ec47f5c64748"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 33}, "timestamps": {"asserted_at": "2026-03-11T07:12:50+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-11T07:12:50+00:00"}, "scope": {"notes": "Affected: parisneo / lollms-webui | Class: ai-system | Severity: Low (CVSS 3.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "parisneo", "30d_avg": 1, "90d_avg": 0, "product": "lollms-webui", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 3.3, "vulnerability_severity": "Low"}}], "references": [{"id": "CVE-2024-4841", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4841"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8ff06bcc-bb2a-4b3c-8211-9c27155ffd78", "vulnerability": {"vulnId": "CVE-2021-38154", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "8ff06bcc-bb2a-4b3c-8211-9c27155ffd78"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-03-11T05:09:48+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-11T05:09:48+00:00"}, "scope": {"notes": "Affected: Canon / Canon devices (various) | Class: printer | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "printer", "7d_avg": 1, "vendor": "Canon", "30d_avg": 7, "90d_avg": 4, "product": "Canon devices (various)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-38154", "url": "https://www.cve.org/CVERecord?id=CVE-2021-38154"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fd0d632a-6d1c-4ce3-b313-b165c927ec17", "vulnerability": {"vulnId": "CVE-2025-15503", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "fd0d632a-6d1c-4ce3-b313-b165c927ec17"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T17:11:06+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T17:11:06+00:00"}, "scope": {"notes": "Affected: Sangfor / Sangfor Operation and Maintenance Management System | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Sangfor", "30d_avg": 2, "90d_avg": 1, "product": "Sangfor Operation and Maintenance Management System", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-15503", "url": "https://www.cve.org/CVERecord?id=CVE-2025-15503"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "cc0ce440-9efa-4ea0-9e3e-d94c55c2c941", "vulnerability": {"vulnId": "CVE-2025-10353", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "cc0ce440-9efa-4ea0-9e3e-d94c55c2c941"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-03-10T17:10:34+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T17:10:34+00:00"}, "scope": {"notes": "Affected: Melis Technology / Melis Platform | Class: other-software | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Melis Technology", "30d_avg": 2, "90d_avg": 2, "product": "Melis Platform", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-10353", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10353"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "db60e281-ede0-4189-aaa7-f2b70f35b6d5", "vulnerability": {"vulnId": "CVE-2021-44868", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "db60e281-ede0-4189-aaa7-f2b70f35b6d5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:56:05+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:56:05+00:00"}, "scope": {"notes": "Affected: ming-soft / MCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ming-soft", "30d_avg": 7, "90d_avg": 4, "product": "MCMS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-44868", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44868"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0eab300f-c4b7-4e97-9e27-058b4b58f30f", "vulnerability": {"vulnId": "CVE-2022-0785", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "0eab300f-c4b7-4e97-9e27-058b4b58f30f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:43:02+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:43:02+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Daily Prayer Time plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Daily Prayer Time plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-0785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0785"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "5733b0ef-4af9-4002-925d-e6103527a14c", "vulnerability": {"vulnId": "CVE-2021-24943", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "5733b0ef-4af9-4002-925d-e6103527a14c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:39+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:39+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Registrations for the Events Calendar plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Registrations for the Events Calendar plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-24943", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24943"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0d55a77e-3ea6-41e1-adbe-34e198abe8fc", "vulnerability": {"vulnId": "CVE-2021-24915", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "0d55a77e-3ea6-41e1-adbe-34e198abe8fc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:37+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:37+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Contest Gallery plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Contest Gallery plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-24915", "url": "https://www.cve.org/CVERecord?id=CVE-2021-24915"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8641b204-6fac-4461-b005-52153089ba41", "vulnerability": {"vulnId": "CVE-2021-4458", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "8641b204-6fac-4461-b005-52153089ba41"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:37:34+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:37:34+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Modern Events Calendar Lite plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Modern Events Calendar Lite plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-4458", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4458"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6f966d24-42ac-4ff5-9f48-3b38e4abddc4", "vulnerability": {"vulnId": "CVE-2020-8656", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "6f966d24-42ac-4ff5-9f48-3b38e4abddc4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:35:22+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:35:22+00:00"}, "scope": {"notes": "Affected: EyesOfNetwork / EyesOfNetwork | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 1, "vendor": "EyesOfNetwork", "30d_avg": 7, "90d_avg": 3, "product": "EyesOfNetwork", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2020-8656", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8656"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ae65ba04-b0d4-43d7-a4ae-d3483856f673", "vulnerability": {"vulnId": "CVE-2019-25141", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ae65ba04-b0d4-43d7-a4ae-d3483856f673"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:28:38+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:28:38+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Easy WP SMTP plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress Easy WP SMTP plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-25141", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25141"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2da958ed-c1f6-458f-9d5c-9ae8c876bdf3", "vulnerability": {"vulnId": "CVE-2018-6605", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2da958ed-c1f6-458f-9d5c-9ae8c876bdf3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-10T16:25:45+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-10T16:25:45+00:00"}, "scope": {"notes": "Affected:  Open Source Matters, Inc/Joomla community / Joomla Zh BaiduMap component | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": " Open Source Matters, Inc/Joomla community", "30d_avg": 3, "90d_avg": 2, "product": "Joomla Zh BaiduMap component", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2018-6605", "url": "https://www.cve.org/CVERecord?id=CVE-2018-6605"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "cd2719bd-852f-497f-b8df-d54ef5bf50d3", "vulnerability": {"vulnId": "CVE-2022-0948", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "cd2719bd-852f-497f-b8df-d54ef5bf50d3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T19:10:59+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T19:10:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Order Listener for WooCommerce WordPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 6, "90d_avg": 3, "product": "Wordpress Order Listener for WooCommerce WordPress plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-0948", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0948"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e928a464-1133-4acf-a03c-24d692ff496a", "vulnerability": {"vulnId": "CVE-2021-4374", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e928a464-1133-4acf-a03c-24d692ff496a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T15:36:35+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T15:36:35+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Automatic Plugin for WordPress | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 5, "90d_avg": 3, "product": "Wordpress Automatic Plugin for WordPress", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-4374", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4374"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "035c8b59-c7a9-4c7f-9801-383fbd6b1aea", "vulnerability": {"vulnId": "CVE-2021-36888", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "035c8b59-c7a9-4c7f-9801-383fbd6b1aea"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T15:34:16+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T15:34:16+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Image Hover Effects Ultimate plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 2, "90d_avg": 2, "product": "Wordpress Image Hover Effects Ultimate plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-36888", "url": "https://www.cve.org/CVERecord?id=CVE-2021-36888"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "621393ec-1878-49ef-9d70-969fb54b46be", "vulnerability": {"vulnId": "CVE-2023-3368", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "621393ec-1878-49ef-9d70-969fb54b46be"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T12:09:19+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T12:09:19+00:00"}, "scope": {"notes": "Affected: Chamilo / Chamilo | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Chamilo", "30d_avg": 3, "90d_avg": 2, "product": "Chamilo", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-3368", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3368"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fc454d6d-3bc8-4d70-a0c1-beffd8e4ea79", "vulnerability": {"vulnId": "CVE-2019-9874", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "fc454d6d-3bc8-4d70-a0c1-beffd8e4ea79"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-03-09T11:39:47+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T11:39:47+00:00"}, "scope": {"notes": "Affected: Citrix / Citrix StoreFront Server | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Citrix", "30d_avg": 3, "90d_avg": 2, "product": "Citrix StoreFront Server", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2019-9874", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2adee1b8-90e1-42a2-b135-815ff058b471", "vulnerability": {"vulnId": "CVE-2019-5434", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "2adee1b8-90e1-42a2-b135-815ff058b471"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-09T11:38:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-09T11:38:53+00:00"}, "scope": {"notes": "Affected: Revive / Revive Adserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Revive", "30d_avg": 5, "90d_avg": 3, "product": "Revive Adserver", "cisa_kev": "no", "connections": 4, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-5434", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5434"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f8671c3f-052a-494f-b046-cdef47bf8962", "vulnerability": {"vulnId": "CVE-2025-4210", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "f8671c3f-052a-494f-b046-cdef47bf8962"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-03-08T21:53:18+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-08T21:53:18+00:00"}, "scope": {"notes": "Affected: Casdoor / Casdoor | Class: ai-system | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "Casdoor", "30d_avg": 3, "90d_avg": 2, "product": "Casdoor", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-4210", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4210"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "301fcbef-def5-4a1a-a2fd-6cdb5c14d934", "vulnerability": {"vulnId": "CVE-2025-27222", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "301fcbef-def5-4a1a-a2fd-6cdb5c14d934"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-07T00:00:00+00:00"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2026-03-07T03:41:05+00:00", "recorded_at": "2026-07-09T01:00:01+00:00", "last_seen_at": "2026-07-07T00:00:00+00:00", "first_seen_at": "2026-03-07T03:41:05+00:00"}, "scope": {"notes": "Affected: Rocket Software / Rocket TRUfusion Enterprise | Class: other-software | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Rocket Software", "30d_avg": 2, "90d_avg": 1, "product": "Rocket TRUfusion Enterprise", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-27222", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27222"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8880d6f5-3bbe-4752-802c-e54bc0869525", "vulnerability": {"vulnId": "CVE-2026-23744", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "8880d6f5-3bbe-4752-802c-e54bc0869525"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2026-03-07T00:11:29+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-07T00:11:29+00:00"}, "scope": {"notes": "Affected: MCPJam / MCPJam Inspector | Class: ai-system | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "MCPJam", "30d_avg": 1, "90d_avg": 1, "product": "MCPJam Inspector", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}], "references": [{"id": "CVE-2026-23744", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23744"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "030bef2d-8546-4246-bf9f-b9168c1627eb", "vulnerability": {"vulnId": "CVE-2026-21891", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "030bef2d-8546-4246-bf9f-b9168c1627eb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-07T00:11:18+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-07T00:11:18+00:00"}, "scope": {"notes": "Affected: IceWhaleTech / ZimaOS | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "IceWhaleTech", "30d_avg": 1, "90d_avg": 2, "product": "ZimaOS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-21891", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21891"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c47f37ee-9801-4ef3-a88b-4c9749d6226b", "vulnerability": {"vulnId": "CVE-2022-47615", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "c47f37ee-9801-4ef3-a88b-4c9749d6226b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-06T23:05:06+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-06T23:05:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 3, "90d_avg": 2, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-47615", "url": "https://www.cve.org/CVERecord?id=CVE-2022-47615"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c83d7218-b959-4b66-90dc-5f2ecc169c67", "vulnerability": {"vulnId": "CVE-2022-38296", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "c83d7218-b959-4b66-90dc-5f2ecc169c67"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-03-06T23:04:04+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-03-06T23:04:04+00:00"}, "scope": {"notes": "Affected: CuppaCMS / CuppaCMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "CuppaCMS", "30d_avg": 7, "90d_avg": 4, "product": "CuppaCMS", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-38296", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38296"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e56c0a2d-7130-42eb-8cc3-e9266451a0a3", "vulnerability": {"vulnId": "CVE-2026-20128", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e56c0a2d-7130-42eb-8cc3-e9266451a0a3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-20T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-03-06T22:35:44+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-20T00:00:00+00:00", "first_seen_at": "2026-03-06T22:35:44+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco SD-WAN Manager | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-03-20: 11", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 1, "90d_avg": 0, "product": "Cisco SD-WAN Manager", "cisa_kev": "no", "connections": 11, "observation_date": "2026-03-20", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-20128", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20128"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e9f030ab-35d7-4be6-84b8-687962f503b2", "vulnerability": {"vulnId": "CVE-2018-25120", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e9f030ab-35d7-4be6-84b8-687962f503b2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-24T23:13:26+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-03-08T00:00:00+00:00", "first_seen_at": "2026-02-24T23:13:26+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DNS-343 ShareCenter | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-03-08: 193", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DNS-343 ShareCenter", "cisa_kev": "no", "connections": 193, "observation_date": "2026-03-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2018-25120", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25120"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7b9d2e33-01ab-49b1-b90a-d771f8f121ee", "vulnerability": {"vulnId": "CVE-2025-64095", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "7b9d2e33-01ab-49b1-b90a-d771f8f121ee"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-23T14:33:28+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-02-23T14:33:28+00:00"}, "scope": {"notes": "Affected: DNN Corp / DNN (DotNetNuke) | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "DNN Corp", "30d_avg": 0, "90d_avg": 1, "product": "DNN (DotNetNuke)", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-64095", "url": "https://www.cve.org/CVERecord?id=CVE-2025-64095"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "db3c364e-cb98-4a9e-be5b-d193a3729287", "vulnerability": {"vulnId": "CVE-2024-6671", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "db3c364e-cb98-4a9e-be5b-d193a3729287"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-02-23T14:21:53+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-02-23T14:21:53+00:00"}, "scope": {"notes": "Affected: Progress / WhatsUp Gold | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Progress", "30d_avg": 6, "90d_avg": 3, "product": "WhatsUp Gold", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2024-6671", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6671"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a73e833c-6418-47ef-88d9-a544f4dd3907", "vulnerability": {"vulnId": "CVE-2026-1603", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "a73e833c-6418-47ef-88d9-a544f4dd3907"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-02-17T05:44:54+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-02-17T05:44:54+00:00"}, "scope": {"notes": "Affected: Ivanti / Ivanti EPM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "Ivanti", "30d_avg": 4, "90d_avg": 14, "product": "Ivanti EPM", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-1603", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1603"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "12ce1d79-c572-418b-812c-8da2125e4eb3", "vulnerability": {"vulnId": "CVE-2025-34042", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "12ce1d79-c572-418b-812c-8da2125e4eb3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-09T23:23:54+00:00"}, "timestamps": {"asserted_at": "2026-02-09T23:23:54+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-09T23:23:54+00:00", "first_seen_at": "2026-02-09T23:23:54+00:00"}, "scope": {"notes": "Affected: BEWARD / BEWARD N100 H.264 VGA IP Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-09: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "BEWARD", "30d_avg": 0, "90d_avg": 0, "product": "BEWARD N100 H.264 VGA IP Camera", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-09", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34042", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34042"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "86891208-3138-4683-80ce-fec97cc1aea3", "vulnerability": {"vulnId": "CVE-2020-24219", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "86891208-3138-4683-80ce-fec97cc1aea3"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-04T16:36:18+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-02-04T16:36:18+00:00", "recorded_at": "2026-06-30T15:06:38+00:00", "last_seen_at": "2026-02-04T16:36:18+00:00", "first_seen_at": "2026-02-04T16:36:18+00:00"}, "scope": {"notes": "Affected: HiSilicon / HiSilicon based hardware video encoders (multiple vendors) | Class: embedded-system | Severity: High (CVSS 7.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2023-07-26: 191", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "HiSilicon", "30d_avg": 0, "90d_avg": 0, "product": "HiSilicon based hardware video encoders (multiple vendors)", "cisa_kev": "no", "connections": 191, "observation_date": "2023-07-26", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2020-24219", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24219"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f9d40386-a969-4d67-90b2-b69264f0a969", "vulnerability": {"vulnId": "CVE-2024-20404", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "f9d40386-a969-4d67-90b2-b69264f0a969"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-02-04T04:17:11+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-02-04T04:17:11+00:00"}, "scope": {"notes": "Affected: Cisco / Cisco Finesse | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Cisco", "30d_avg": 0, "90d_avg": 0, "product": "Cisco Finesse", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2024-20404", "url": "https://www.cve.org/CVERecord?id=CVE-2024-20404"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "841b2945-1545-47e7-ac96-2c90ddbc342d", "vulnerability": {"vulnId": "CVE-2025-10211", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "841b2945-1545-47e7-ac96-2c90ddbc342d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-01-31T16:30:54+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-01-31T16:30:54+00:00"}, "scope": {"notes": "Affected: ChanCMS / ChanCMS | Class: cms | Severity: Medium (CVSS 6.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ChanCMS", "30d_avg": 0, "90d_avg": 0, "product": "ChanCMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-10211", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10211"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "061ad775-dc3f-4db7-a214-7f9bed77a3b1", "vulnerability": {"vulnId": "CVE-2015-10145", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "061ad775-dc3f-4db7-a214-7f9bed77a3b1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-10T00:00:00+00:00"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-01-31T14:30:16+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-10T00:00:00+00:00", "first_seen_at": "2026-01-31T14:30:16+00:00"}, "scope": {"notes": "Affected: Gargoyle / Gargoyle Router | Class: router | Severity: High (CVSS 8.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-10: 7", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Gargoyle", "30d_avg": 0, "90d_avg": 0, "product": "Gargoyle Router", "cisa_kev": "no", "connections": 7, "observation_date": "2026-02-10", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2015-10145", "url": "https://www.cve.org/CVERecord?id=CVE-2015-10145"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "38efb772-4ff0-4c1a-bd4f-c1bddd818087", "vulnerability": {"vulnId": "CVE-2026-1281", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "38efb772-4ff0-4c1a-bd4f-c1bddd818087"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-31T10:10:41+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T00:00:00+00:00", "first_seen_at": "2026-01-31T10:10:41+00:00"}, "scope": {"notes": "Affected: Ivanti / Endpoint Manager Mobile (EPMM), formerly MobileIron Core | Class: mobile-device-management | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-02: 31837", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "16", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "mobile-device-management", "7d_avg": 3, "vendor": "Ivanti", "30d_avg": 0, "90d_avg": 0, "product": "Endpoint Manager Mobile (EPMM), formerly MobileIron Core", "cisa_kev": "yes", "connections": 31837, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1281", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1281"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ed1c70c8-11ff-4723-9101-6e002ce6a1bf", "vulnerability": {"vulnId": "CVE-2025-34022", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ed1c70c8-11ff-4723-9101-6e002ce6a1bf"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-01-29T17:29:16+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-01-29T17:29:16+00:00"}, "scope": {"notes": "Affected: Selea / Selea Targa IP OCR-ANPR Camera | Class: video-system | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-30: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "video-system", "7d_avg": 0, "vendor": "Selea", "30d_avg": 0, "90d_avg": 0, "product": "Selea Targa IP OCR-ANPR Camera", "cisa_kev": "no", "connections": 1, "observation_date": "2026-06-30", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34022", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34022"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e030fc63-e9bc-49ce-9fa8-045e2382d22b", "vulnerability": {"vulnId": "CVE-2025-34048", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e030fc63-e9bc-49ce-9fa8-045e2382d22b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-01-29T17:09:04+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-01-29T17:09:04+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DSL-2730U/2750U/2750E | Class: router | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-06-30: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 5, "90d_avg": 1, "product": "D-Link DSL-2730U/2750U/2750E", "cisa_kev": "no", "connections": 1, "observation_date": "2026-06-30", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34048", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34048"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "05f648da-e220-47b1-9b51-6b46568a1f03", "vulnerability": {"vulnId": "CVE-2025-34044", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "05f648da-e220-47b1-9b51-6b46568a1f03"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-05T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-01-29T16:41:59+00:00", "recorded_at": "2026-07-07T01:00:02+00:00", "last_seen_at": "2026-07-05T00:00:00+00:00", "first_seen_at": "2026-01-29T16:41:59+00:00"}, "scope": {"notes": "Affected: Shenzhen Lingkong Technology / WIFISKY 7-layer flow control router | Class: router | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-05: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Lingkong Technology", "30d_avg": 0, "90d_avg": 0, "product": "WIFISKY 7-layer flow control router", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-05", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34044", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34044"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "182f17a7-cabe-4430-a1b9-f7e684a73a5b", "vulnerability": {"vulnId": "CVE-2025-44846", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "182f17a7-cabe-4430-a1b9-f7e684a73a5b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-12T00:00:00+00:00"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-01-29T10:41:36+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-12T00:00:00+00:00", "first_seen_at": "2026-01-29T10:41:36+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink CA600-PoE | Class: router | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-12: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink CA600-PoE", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-12", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-44846", "url": "https://www.cve.org/CVERecord?id=CVE-2025-44846"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e8f21649-ee63-4354-80c2-27371a7d731b", "vulnerability": {"vulnId": "CVE-2020-20300", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "e8f21649-ee63-4354-80c2-27371a7d731b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-30T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-01-28T06:31:59+00:00", "recorded_at": "2026-07-02T01:00:01+00:00", "last_seen_at": "2026-06-30T00:00:00+00:00", "first_seen_at": "2026-01-28T06:31:59+00:00"}, "scope": {"notes": "Affected: WeiPHP / WeiPHP | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-30: 12", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "WeiPHP", "30d_avg": 5, "90d_avg": 1, "product": "WeiPHP", "cisa_kev": "no", "connections": 12, "observation_date": "2026-06-30", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2020-20300", "url": "https://www.cve.org/CVERecord?id=CVE-2020-20300"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ca4c2094-3c47-49af-866b-1acdf8345f24", "vulnerability": {"vulnId": "CVE-2025-47188", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "ca4c2094-3c47-49af-866b-1acdf8345f24"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-05T00:00:00+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-01-28T06:25:40+00:00", "recorded_at": "2026-07-07T01:00:02+00:00", "last_seen_at": "2026-07-05T00:00:00+00:00", "first_seen_at": "2026-01-28T06:25:40+00:00"}, "scope": {"notes": "Affected: Mitel / Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, 6970 Conference Unit | Class: voip | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-05: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Mitel", "30d_avg": 0, "90d_avg": 0, "product": "Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, 6970 Conference Unit", "cisa_kev": "no", "connections": 3, "observation_date": "2026-07-05", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-47188", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47188"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1a581b3a-8460-4d4c-93ce-db446e30051b", "vulnerability": {"vulnId": "CVE-2026-21858", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "1a581b3a-8460-4d4c-93ce-db446e30051b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-08T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-01-27T23:40:56+00:00", "recorded_at": "2026-07-10T01:00:01+00:00", "last_seen_at": "2026-07-08T00:00:00+00:00", "first_seen_at": "2026-01-27T23:40:56+00:00"}, "scope": {"notes": "Affected: n8n / n8n | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-08: 104", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "n8n", "30d_avg": 0, "90d_avg": 0, "product": "n8n", "cisa_kev": "no", "connections": 104, "observation_date": "2026-07-08", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-21858", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21858"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "63005d29-cf03-4141-9c5e-04ca5b78b636", "vulnerability": {"vulnId": "CVE-2022-40619", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "gna": 1, "object_uuid": "63005d29-cf03-4141-9c5e-04ca5b78b636"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-02-11T00:00:00+00:00"}, "characteristics": {"severity": 77}, "timestamps": {"asserted_at": "2026-01-26T20:12:10+00:00", "recorded_at": "2026-06-30T09:44:01+00:00", "last_seen_at": "2026-02-11T00:00:00+00:00", "first_seen_at": "2026-01-26T20:12:10+00:00"}, "scope": {"notes": "Affected: NETGEAR / NETGEAR devices with FunJSQ | Class: router | Severity: High (CVSS 7.7) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-02-11: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "NETGEAR", "30d_avg": 0, "90d_avg": 0, "product": "NETGEAR devices with FunJSQ", "cisa_kev": "no", "connections": 4, "observation_date": "2026-02-11", "vulnerability_class": "CVSS", "vulnerability_score": 7.7, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2022-40619", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40619"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}]}