{"metadata": {"count": 1307, "page": 1, "per_page": 100}, "data": [{"uuid": "22b09918-1467-43d5-b674-017c2cdb1310", "vulnerability": {"vulnId": "CVE-2026-58457", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "22b09918-1467-43d5-b674-017c2cdb1310"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T23:39:32+00:00"}, "characteristics": {"severity": 93}, "timestamps": {"asserted_at": "2026-09-07T23:39:32+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T23:39:32+00:00", "first_seen_at": "2026-09-07T23:39:32+00:00"}, "scope": {"notes": "Affected: Shenzhen Aitemi / M300 Wi-Fi Repeater | Class: router | Severity: Critical (CVSS 9.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Shenzhen Aitemi", "30d_avg": 0, "90d_avg": 0, "product": "M300 Wi-Fi Repeater", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.3, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-58457", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58457"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f72ceaad-40ec-4b56-8d4c-b93cc3f5d9a5", "vulnerability": {"vulnId": "CVE-2025-14208", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "f72ceaad-40ec-4b56-8d4c-b93cc3f5d9a5"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T11:08:02+00:00"}, "characteristics": {"severity": 63}, "timestamps": {"asserted_at": "2026-09-07T11:08:02+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T11:08:02+00:00", "first_seen_at": "2026-09-07T11:08:02+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: Medium (CVSS 6.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 33", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "no", "connections": 33, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-14208", "url": "https://www.cve.org/CVERecord?id=CVE-2025-14208"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d961db1a-c89b-42d2-a973-eb99db7f6e95", "vulnerability": {"vulnId": "CVE-2023-37569", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d961db1a-c89b-42d2-a973-eb99db7f6e95"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:34+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-09-07T00:07:34+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:34+00:00", "first_seen_at": "2026-09-07T00:07:34+00:00"}, "scope": {"notes": "Affected: ESDS / Emagic Data Center Management Suite | Class: device-management-platform | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "ESDS", "30d_avg": 0, "90d_avg": 0, "product": "Emagic Data Center Management Suite", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-37569", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37569"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c94e3b72-20a1-42ac-b271-297b223752f4", "vulnerability": {"vulnId": "CVE-2025-60687", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c94e3b72-20a1-42ac-b271-297b223752f4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:34+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-09-07T00:07:34+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:34+00:00", "first_seen_at": "2026-09-07T00:07:34+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink LR1200GB | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink LR1200GB", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-60687", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60687"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "eb8403ad-63bb-4b26-8ca3-8125f9e29f27", "vulnerability": {"vulnId": "CVE-2025-6068", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "eb8403ad-63bb-4b26-8ca3-8125f9e29f27"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:07:33+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-09-07T00:07:33+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:07:33+00:00", "first_seen_at": "2026-09-07T00:07:33+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A720R | Class: router | Severity: Medium (CVSS 6.5) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A720R", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2025-6068", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6068"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "4e99d3a4-94dc-4edc-b5a3-095e7874c7ca", "vulnerability": {"vulnId": "CVE-2025-4008", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "4e99d3a4-94dc-4edc-b5a3-095e7874c7ca"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T09:51:52+00:00"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-09-06T09:51:52+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T09:51:52+00:00", "first_seen_at": "2026-09-06T09:51:52+00:00"}, "scope": {"notes": "Affected: Smartbedded / MeteoBridge | Class: embedded-system | Severity: High (CVSS 8.7) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 36", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 0, "vendor": "Smartbedded", "30d_avg": 0, "90d_avg": 0, "product": "MeteoBridge", "cisa_kev": "yes", "connections": 36, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-4008", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4008"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "55748aaf-6d2e-421d-a784-d59b61a2473d", "vulnerability": {"vulnId": "CVE-2025-60698", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "55748aaf-6d2e-421d-a784-d59b61a2473d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-09-05T16:20:48+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-05T16:20:48+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-882 | Class: router | Severity: High (CVSS 7.3) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-882", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-60698", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60698"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3f92c81d-da12-4881-a358-621dcb5f904e", "vulnerability": {"vulnId": "CVE-2026-9586", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "3f92c81d-da12-4881-a358-621dcb5f904e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-04T20:34:27+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-04T20:34:27+00:00"}, "scope": {"notes": "Affected: Sangoma / Sangoma Switchvox | Class: voip | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Sangoma", "30d_avg": 0, "90d_avg": 0, "product": "Sangoma Switchvox", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-9586", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9586"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1f499020-b2b1-4006-a999-87497f7eb858", "vulnerability": {"vulnId": "CVE-2019-10655", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "1f499020-b2b1-4006-a999-87497f7eb858"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-04T19:37:32+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-04T19:37:32+00:00"}, "scope": {"notes": "Affected: Grandstream / GXV3240/GXP2200 | Class: voip | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "voip", "7d_avg": 0, "vendor": "Grandstream", "30d_avg": 0, "90d_avg": 0, "product": "GXV3240/GXP2200", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-10655", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10655"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2c32c5e0-2e06-4aef-b950-4945ff0ada71", "vulnerability": {"vulnId": "CVE-2026-1547", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "2c32c5e0-2e06-4aef-b950-4945ff0ada71"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-09-01T16:27:16+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:16+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A7000R | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A7000R", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1547", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1547"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "dfbf47ce-2d94-42e9-a862-a093630e95e1", "vulnerability": {"vulnId": "CVE-2025-60702", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "dfbf47ce-2d94-42e9-a862-a093630e95e1"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2026-09-01T16:27:15+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:15+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink A950RG | Class: router | Severity: None (CVSS 0) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink A950RG", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}], "references": [{"id": "CVE-2025-60702", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60702"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7333604f-a5bd-451b-a030-f498e98db245", "vulnerability": {"vulnId": "CVE-2026-78141", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "7333604f-a5bd-451b-a030-f498e98db245"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 74}, "timestamps": {"asserted_at": "2026-09-01T16:27:10+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T16:27:10+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda CH22 | Class: router | Severity: High (CVSS 7.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda CH22", "cisa_kev": "no", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.4, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-78141", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78141"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "71d0e8a2-c1a9-45f4-b76d-998a098bec8c", "vulnerability": {"vulnId": "CVE-2026-5153", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "71d0e8a2-c1a9-45f4-b76d-998a098bec8c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-09-01T15:42:51+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-09-01T15:42:51+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda CH22 | Class: router | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Tenda", "30d_avg": 0, "90d_avg": 0, "product": "Tenda CH22", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-5153", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5153"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b60acd62-02ef-40cd-aca4-f68678d831b7", "vulnerability": {"vulnId": "CVE-2024-0250", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "b60acd62-02ef-40cd-aca4-f68678d831b7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-09-01T02:44:06+00:00", "recorded_at": "2026-09-07T01:00:02+00:00", "last_seen_at": "2026-09-05T00:00:00+00:00", "first_seen_at": "2026-09-01T02:44:06+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpres Analytics Insights for Google Analytics 4 (AIWP) plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-05: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpres Analytics Insights for Google Analytics 4 (AIWP) plugin", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-05", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2024-0250", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0250"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "08dcde3a-d074-4b0a-bf41-b40c0a9e5469", "vulnerability": {"vulnId": "CVE-2016-20097", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "08dcde3a-d074-4b0a-bf41-b40c0a9e5469"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T00:36:23+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-09-01T00:36:23+00:00", "recorded_at": "2026-09-03T01:00:01+00:00", "last_seen_at": "2026-09-01T00:36:23+00:00", "first_seen_at": "2026-09-01T00:36:23+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-01: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2016-20097", "url": "https://www.cve.org/CVERecord?id=CVE-2016-20097"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "dd496a9e-c2e2-410b-9092-33a128191e66", "vulnerability": {"vulnId": "CVE-2023-39470", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "dd496a9e-c2e2-410b-9092-33a128191e66"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-09-01T00:27:38+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-09-01T00:27:38+00:00"}, "scope": {"notes": "Affected: PaperCut / PaperCut NG | Class: device-management-platform | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 38", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "PaperCut", "30d_avg": 0, "90d_avg": 0, "product": "PaperCut NG", "cisa_kev": "no", "connections": 38, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-39470", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39470"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "99f52484-d752-44bc-8950-19087b142e35", "vulnerability": {"vulnId": "CVE-2026-72898", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "99f52484-d752-44bc-8950-19087b142e35"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-08-31T10:23:21+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-31T10:23:21+00:00"}, "scope": {"notes": "Affected: Metabase / Metabase | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 38", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 2, "vendor": "Metabase", "30d_avg": 0, "90d_avg": 0, "product": "Metabase", "cisa_kev": "yes", "connections": 38, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-72898", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c65e90ac-2f3a-4cec-bcd9-8d513462133e", "vulnerability": {"vulnId": "CVE-2022-4995", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c65e90ac-2f3a-4cec-bcd9-8d513462133e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-30T12:05:29+00:00", "recorded_at": "2026-09-06T01:00:01+00:00", "last_seen_at": "2026-09-04T00:00:00+00:00", "first_seen_at": "2026-08-30T12:05:29+00:00"}, "scope": {"notes": "Affected: Weaver / E-cology | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-04: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "E-cology", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-4995", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4995"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d4effaa7-0098-4fe6-81be-a898e1230dfd", "vulnerability": {"vulnId": "CVE-2023-7330", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d4effaa7-0098-4fe6-81be-a898e1230dfd"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-29T10:57:44+00:00"}, "timestamps": {"asserted_at": "2026-08-29T10:57:44+00:00", "recorded_at": "2026-08-31T01:00:02+00:00", "last_seen_at": "2026-08-29T10:57:44+00:00", "first_seen_at": "2026-08-29T10:57:44+00:00"}, "scope": {"notes": "Affected: Ruijie Networks / unknown | Class: unknown | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-29: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "unknown", "7d_avg": 0, "vendor": "Ruijie Networks", "30d_avg": 0, "90d_avg": 0, "product": "unknown", "cisa_kev": "no", "connections": 1, "observation_date": "2026-08-29", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2023-7330", "url": "https://www.cve.org/CVERecord?id=CVE-2023-7330"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6188c656-6f5d-4853-a461-42ce2fa1f7f0", "vulnerability": {"vulnId": "CVE-2022-50997", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "6188c656-6f5d-4853-a461-42ce2fa1f7f0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-08-28T06:40:42+00:00", "recorded_at": "2026-09-04T01:00:01+00:00", "last_seen_at": "2026-09-02T00:00:00+00:00", "first_seen_at": "2026-08-28T06:40:42+00:00"}, "scope": {"notes": "Affected: Weaver / E-cology | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-02: 9", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "E-cology", "cisa_kev": "no", "connections": 9, "observation_date": "2026-09-02", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2022-50997", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50997"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "705b0afa-a4de-44d2-9762-2350a6228920", "vulnerability": {"vulnId": "CVE-2019-25765", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "705b0afa-a4de-44d2-9762-2350a6228920"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 87}, "timestamps": {"asserted_at": "2026-08-28T03:52:04+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-28T03:52:04+00:00"}, "scope": {"notes": "Affected: ASP-CMS Project / ASP-CMS | Class: cms | Severity: High (CVSS 8.7) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "ASP-CMS Project", "30d_avg": 0, "90d_avg": 0, "product": "ASP-CMS", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.7, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2019-25765", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25765"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8c74cd20-479a-4b86-97fd-2ebc21dab358", "vulnerability": {"vulnId": "CVE-2024-58374", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "8c74cd20-479a-4b86-97fd-2ebc21dab358"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-08-28T03:51:20+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-28T03:51:20+00:00"}, "scope": {"notes": "Affected: Hongjing Century / Hongjing Century e-HR | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hongjing Century", "30d_avg": 0, "90d_avg": 0, "product": "Hongjing Century e-HR", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-58374", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58374"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "27d89d4b-7ab5-4816-9205-9d4af01a5941", "vulnerability": {"vulnId": "CVE-2026-29059", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "27d89d4b-7ab5-4816-9205-9d4af01a5941"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 69}, "timestamps": {"asserted_at": "2026-08-27T18:00:23+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-27T18:00:23+00:00"}, "scope": {"notes": "Affected: windmill-labs / windmill | Class: other-software | Severity: Medium (CVSS 6.9) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "windmill-labs", "30d_avg": 0, "90d_avg": 0, "product": "windmill", "cisa_kev": "no", "connections": 3, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.9, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2026-29059", "url": "https://www.cve.org/CVERecord?id=CVE-2026-29059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "037192de-e3a0-4ed4-8dea-11234de97f13", "vulnerability": {"vulnId": "CVE-2025-55583", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "037192de-e3a0-4ed4-8dea-11234de97f13"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-25T17:49:41+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-25T17:49:41+00:00", "recorded_at": "2026-08-27T01:00:01+00:00", "last_seen_at": "2026-08-25T17:49:41+00:00", "first_seen_at": "2026-08-25T17:49:41+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-868L | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-08-25: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-868L", "cisa_kev": "no", "connections": 1, "observation_date": "2026-08-25", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-55583", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55583"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "232b04f7-e8d4-4664-af08-6beefad308ba", "vulnerability": {"vulnId": "CVE-2026-76904", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "232b04f7-e8d4-4664-af08-6beefad308ba"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-24T22:08:39+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-24T22:08:39+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 6", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Geoserver", "30d_avg": 0, "90d_avg": 0, "product": "Geoserver", "cisa_kev": "no", "connections": 6, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-76904", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76904"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c8c5b114-167f-4128-9002-dca9e7595b22", "vulnerability": {"vulnId": "CVE-2024-12912", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c8c5b114-167f-4128-9002-dca9e7595b22"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-08-24T18:59:09+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-24T18:59:09+00:00"}, "scope": {"notes": "Affected: ASUS / ASUS AiCloud | Class: router | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 5, "vendor": "ASUS", "30d_avg": 1, "90d_avg": 0, "product": "ASUS AiCloud", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-12912", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12912"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "46236c8d-db13-4637-bdfe-e6e6dbfa9cf0", "vulnerability": {"vulnId": "CVE-2026-73570", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "46236c8d-db13-4637-bdfe-e6e6dbfa9cf0"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 89}, "timestamps": {"asserted_at": "2026-08-23T21:06:14+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-23T21:06:14+00:00"}, "scope": {"notes": "Affected: Synacor / Zimbra Collaboration Suite | Class: email | Severity: High (CVSS 8.9) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 1, "vendor": "Synacor", "30d_avg": 0, "90d_avg": 0, "product": "Zimbra Collaboration Suite", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.9, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-73570", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73570"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "815c1fb3-3e79-44b3-bdc9-ee99f5760646", "vulnerability": {"vulnId": "CVE-2025-10164", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "815c1fb3-3e79-44b3-bdc9-ee99f5760646"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 73}, "timestamps": {"asserted_at": "2026-08-22T22:01:03+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-22T22:01:03+00:00"}, "scope": {"notes": "Affected: lmsys / lmsys sglang | Class: ai-system | Severity: High (CVSS 7.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 15", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "lmsys", "30d_avg": 0, "90d_avg": 0, "product": "lmsys sglang", "cisa_kev": "no", "connections": 15, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-10164", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10164"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7bf44949-9df9-4cdf-a7f1-5bc464b1341f", "vulnerability": {"vulnId": "CVE-2021-27691", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "7bf44949-9df9-4cdf-a7f1-5bc464b1341f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-22T21:59:23+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-22T21:59:23+00:00"}, "scope": {"notes": "Affected: Tenda / Tenda G0/G1/G3 | Class: router | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 18", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "8", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 15, "vendor": "Tenda", "30d_avg": 50, "90d_avg": 16, "product": "Tenda G0/G1/G3", "cisa_kev": "no", "connections": 18, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2021-27691", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27691"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a8e23f40-e3ad-4d4d-83e6-96a74df46886", "vulnerability": {"vulnId": "CVE-2019-12725", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "a8e23f40-e3ad-4d4d-83e6-96a74df46886"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-22T17:28:07+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-22T17:28:07+00:00"}, "scope": {"notes": "Affected: Zeroshell / Zeroshell Linux Router | Class: embedded-system | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "embedded-system", "7d_avg": 1, "vendor": "Zeroshell", "30d_avg": 0, "90d_avg": 0, "product": "Zeroshell Linux Router", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2019-12725", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12725"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "11f3b264-6692-42d0-ba8c-df9412b6827a", "vulnerability": {"vulnId": "CVE-2023-25158", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "11f3b264-6692-42d0-ba8c-df9412b6827a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-31T00:00:00+00:00"}, "characteristics": {"severity": 0}, "timestamps": {"asserted_at": "2026-08-19T10:51:54+00:00", "recorded_at": "2026-09-02T01:00:02+00:00", "last_seen_at": "2026-08-31T00:00:00+00:00", "first_seen_at": "2026-08-19T10:51:54+00:00"}, "scope": {"notes": "Affected: Geoserver / Geoserver | Class: other-software | Severity: None (CVSS 0) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-31: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Geoserver", "30d_avg": 0, "90d_avg": 0, "product": "Geoserver", "cisa_kev": "no", "connections": 3, "observation_date": "2026-08-31", "vulnerability_class": "CVSS", "vulnerability_score": 0, "vulnerability_severity": "None"}}], "references": [{"id": "CVE-2023-25158", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25158"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1e1aebab-c176-4ca2-b973-8088583ae7b2", "vulnerability": {"vulnId": "CVE-2022-50973", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "1e1aebab-c176-4ca2-b973-8088583ae7b2"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-29T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-17T22:42:10+00:00", "recorded_at": "2026-08-31T01:00:02+00:00", "last_seen_at": "2026-08-29T00:00:00+00:00", "first_seen_at": "2026-08-17T22:42:10+00:00"}, "scope": {"notes": "Affected: Yonyou / Yonyou KSOA | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-29: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Yonyou", "30d_avg": 0, "90d_avg": 0, "product": "Yonyou KSOA", "cisa_kev": "no", "connections": 1, "observation_date": "2026-08-29", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-50973", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50973"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0f2cbd31-80b1-412d-9ce8-5c502ce93ad9", "vulnerability": {"vulnId": "CVE-2025-52907", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "0f2cbd31-80b1-412d-9ce8-5c502ce93ad9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-18T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-08-17T03:16:52+00:00", "recorded_at": "2026-08-20T01:00:01+00:00", "last_seen_at": "2026-08-18T00:00:00+00:00", "first_seen_at": "2026-08-17T03:16:52+00:00"}, "scope": {"notes": "Affected: Totolink / Totolink X6000R | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-08-18: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "Totolink", "30d_avg": 0, "90d_avg": 0, "product": "Totolink X6000R", "cisa_kev": "no", "connections": 2, "observation_date": "2026-08-18", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-52907", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52907"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8a8e0cf0-9ff8-4ecd-aa4f-16972d4659a4", "vulnerability": {"vulnId": "CVE-2026-50522", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "8a8e0cf0-9ff8-4ecd-aa4f-16972d4659a4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-16T20:47:29+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-16T20:47:29+00:00"}, "scope": {"notes": "Affected: Microsoft / SharePoint | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 47", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 2, "vendor": "Microsoft", "30d_avg": 3, "90d_avg": 1, "product": "SharePoint", "cisa_kev": "yes", "connections": 47, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-50522", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50522"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "eceab901-4208-4717-bcd3-3efacb9142cc", "vulnerability": {"vulnId": "CVE-2021-2109", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "eceab901-4208-4717-bcd3-3efacb9142cc"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-08-15T23:19:31+00:00", "recorded_at": "2026-09-07T01:00:02+00:00", "last_seen_at": "2026-09-05T00:00:00+00:00", "first_seen_at": "2026-08-15T23:19:31+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle WebLogic Server (Oracle Fusion Middleware) | Class: app-server | Severity: High (CVSS 7.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-05: 130", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle WebLogic Server (Oracle Fusion Middleware)", "cisa_kev": "no", "connections": 130, "observation_date": "2026-09-05", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-2109", "url": "https://www.cve.org/CVERecord?id=CVE-2021-2109"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a89141a5-2a65-404b-88ee-1b729e6525df", "vulnerability": {"vulnId": "CVE-2016-5312", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "a89141a5-2a65-404b-88ee-1b729e6525df"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 65}, "timestamps": {"asserted_at": "2026-08-15T12:52:42+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-15T12:52:42+00:00"}, "scope": {"notes": "Affected: Symantec / Symantec Messaging Gateway | Class: email | Severity: Medium (CVSS 6.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 8", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Symantec", "30d_avg": 0, "90d_avg": 0, "product": "Symantec Messaging Gateway", "cisa_kev": "no", "connections": 8, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 6.5, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2016-5312", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5312"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f0ba5eec-7ded-401b-9d0b-0df9627e6279", "vulnerability": {"vulnId": "CVE-2026-45298", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "f0ba5eec-7ded-401b-9d0b-0df9627e6279"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2026-08-14T19:18:57+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-14T19:18:57+00:00"}, "scope": {"notes": "Affected: amir20 / Dozzle | Class: other-software | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 24", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "amir20", "30d_avg": 0, "90d_avg": 0, "product": "Dozzle", "cisa_kev": "no", "connections": 24, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-45298", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45298"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e1a1efe6-3b6c-476c-90b6-f3707e522f49", "vulnerability": {"vulnId": "CVE-2023-33538", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "e1a1efe6-3b6c-476c-90b6-f3707e522f49"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-12T18:35:04+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-08-12T18:35:04+00:00", "recorded_at": "2026-08-14T01:00:01+00:00", "last_seen_at": "2026-08-12T18:35:04+00:00", "first_seen_at": "2026-08-12T18:35:04+00:00"}, "scope": {"notes": "Affected: TP-Link / TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-08-12: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "TP-Link", "30d_avg": 0, "90d_avg": 0, "product": "TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2", "cisa_kev": "yes", "connections": 3, "observation_date": "2026-08-12", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-33538", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33538"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6a8da635-47fc-47a2-98a6-51b0d63607cb", "vulnerability": {"vulnId": "CVE-2023-3722", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "6a8da635-47fc-47a2-98a6-51b0d63607cb"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-09T20:27:16+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-09T20:27:16+00:00"}, "scope": {"notes": "Affected: Avaya / Avaya Aura Device Services | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 47", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 2, "vendor": "Avaya", "30d_avg": 1, "90d_avg": 0, "product": "Avaya Aura Device Services", "cisa_kev": "no", "connections": 47, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-3722", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3722"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "df9f9703-c4c1-415c-89ed-5449bb1086f6", "vulnerability": {"vulnId": "CVE-2026-2652", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "df9f9703-c4c1-415c-89ed-5449bb1086f6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 86}, "timestamps": {"asserted_at": "2026-08-07T16:02:51+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-07T16:02:51+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: ai-system | Severity: High (CVSS 8.6) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 2749", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "16", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 20, "vendor": "MLflow", "30d_avg": 5, "90d_avg": 1, "product": "MLflow", "cisa_kev": "no", "connections": 2749, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.6, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-2652", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2652"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "57ea4820-357f-4cef-8e99-8e5116edc98b", "vulnerability": {"vulnId": "CVE-2018-14013", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "57ea4820-357f-4cef-8e99-8e5116edc98b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-08-06T01:46:08+00:00", "recorded_at": "2026-09-07T01:00:02+00:00", "last_seen_at": "2026-09-05T00:00:00+00:00", "first_seen_at": "2026-08-06T01:46:08+00:00"}, "scope": {"notes": "Affected: Synacor / Synacor Zimbra Collaboration Suite | Class: email | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-05: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 0, "vendor": "Synacor", "30d_avg": 0, "90d_avg": 0, "product": "Synacor Zimbra Collaboration Suite", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-05", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2018-14013", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14013"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "1f18c97d-c58e-42c8-b916-acd85df6fcee", "vulnerability": {"vulnId": "CVE-2026-28409", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "1f18c97d-c58e-42c8-b916-acd85df6fcee"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-08-04T19:40:54+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-04T19:40:54+00:00"}, "scope": {"notes": "Affected: LabRedesCefetRJ / WeGIA | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 42", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "LabRedesCefetRJ", "30d_avg": 0, "90d_avg": 0, "product": "WeGIA", "cisa_kev": "no", "connections": 42, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-28409", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28409"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "55a55be7-3f29-4e09-84df-0ebb77974450", "vulnerability": {"vulnId": "CVE-2026-38992", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "55a55be7-3f29-4e09-84df-0ebb77974450"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-16T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-08-03T23:14:25+00:00", "recorded_at": "2026-08-18T01:00:01+00:00", "last_seen_at": "2026-08-16T00:00:00+00:00", "first_seen_at": "2026-08-03T23:14:25+00:00"}, "scope": {"notes": "Affected: Cockpit-HQ / Cockpit CMS | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-16: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Cockpit-HQ", "30d_avg": 0, "90d_avg": 0, "product": "Cockpit CMS", "cisa_kev": "no", "connections": 3, "observation_date": "2026-08-16", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-38992", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38992"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d60cc780-114d-429d-9970-b7a29bfb3449", "vulnerability": {"vulnId": "CVE-2024-58274", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d60cc780-114d-429d-9970-b7a29bfb3449"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-03T04:20:03+00:00"}, "characteristics": {"severity": 83}, "timestamps": {"asserted_at": "2026-08-03T04:20:03+00:00", "recorded_at": "2026-08-05T01:00:01+00:00", "last_seen_at": "2026-08-03T04:20:03+00:00", "first_seen_at": "2026-08-03T04:20:03+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision CSMP iSecure Center | Class: device-management-platform | Severity: High (CVSS 8.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-03: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Hikvision CSMP iSecure Center", "cisa_kev": "no", "connections": 2, "observation_date": "2026-08-03", "vulnerability_class": "CVSS", "vulnerability_score": 8.3, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-58274", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58274"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8268832d-da9f-456a-995c-31a41b732673", "vulnerability": {"vulnId": "CVE-2026-8054", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "8268832d-da9f-456a-995c-31a41b732673"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-08-03T04:13:04+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-03T04:13:04+00:00"}, "scope": {"notes": "Affected: dotCMS / dotCMS | Class: cms | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 24", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "dotCMS", "30d_avg": 0, "90d_avg": 0, "product": "dotCMS", "cisa_kev": "no", "connections": 24, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-8054", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d0915be4-5b26-497a-8ac4-8ad2e89f7ef4", "vulnerability": {"vulnId": "CVE-2026-54066", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d0915be4-5b26-497a-8ac4-8ad2e89f7ef4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-08-03T04:12:29+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-03T04:12:29+00:00"}, "scope": {"notes": "Affected: SiYuan / SiYuan | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 42", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "SiYuan", "30d_avg": 0, "90d_avg": 0, "product": "SiYuan", "cisa_kev": "no", "connections": 42, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-54066", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54066"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6d6b111a-b211-4bf6-b493-1505280d1036", "vulnerability": {"vulnId": "CVE-2026-48313", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "6d6b111a-b211-4bf6-b493-1505280d1036"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-08-03T04:12:13+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-08-03T04:12:13+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe ColdFusion | Class: app-server | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe ColdFusion", "cisa_kev": "no", "connections": 3, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-48313", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48313"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2657c8e4-8dce-4b45-9a29-9a056c8b036e", "vulnerability": {"vulnId": "CVE-2026-28496", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "2657c8e4-8dce-4b45-9a29-9a056c8b036e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 94}, "timestamps": {"asserted_at": "2026-08-03T04:09:52+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-08-03T04:09:52+00:00"}, "scope": {"notes": "Affected: FOSSBilling / FOSSBilling | Class: other-software | Severity: Critical (CVSS 9.4) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 40", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "FOSSBilling", "30d_avg": 0, "90d_avg": 0, "product": "FOSSBilling", "cisa_kev": "no", "connections": 40, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.4, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-28496", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28496"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "704d3329-1c19-463b-8f26-063d20bb8a97", "vulnerability": {"vulnId": "CVE-2023-54359", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "704d3329-1c19-463b-8f26-063d20bb8a97"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-02T00:00:00+00:00"}, "characteristics": {"severity": 82}, "timestamps": {"asserted_at": "2026-08-02T21:33:36+00:00", "recorded_at": "2026-09-04T01:00:01+00:00", "last_seen_at": "2026-09-02T00:00:00+00:00", "first_seen_at": "2026-08-02T21:33:36+00:00"}, "scope": {"notes": "Affected: Wordpress / adivaha Travel Plugin for Wordpress | Class: cms | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-02: 9", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "adivaha Travel Plugin for Wordpress", "cisa_kev": "no", "connections": 9, "observation_date": "2026-09-02", "vulnerability_class": "CVSS", "vulnerability_score": 8.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-54359", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54359"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "eb647c19-687b-477a-90e2-2254d4fac732", "vulnerability": {"vulnId": "CVE-2023-2825", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "eb647c19-687b-477a-90e2-2254d4fac732"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-21T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-08-02T17:01:11+00:00", "recorded_at": "2026-08-23T01:00:02+00:00", "last_seen_at": "2026-08-21T00:00:00+00:00", "first_seen_at": "2026-08-02T17:01:11+00:00"}, "scope": {"notes": "Affected: GitLab / GitLab CE/EE | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-21: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "GitLab", "30d_avg": 0, "90d_avg": 0, "product": "GitLab CE/EE", "cisa_kev": "no", "connections": 1, "observation_date": "2026-08-21", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-2825", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2825"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "de19ad3f-8d7c-49f0-b425-898a39179f5a", "vulnerability": {"vulnId": "CVE-2025-71324", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "de19ad3f-8d7c-49f0-b425-898a39179f5a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-21T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-08-02T17:00:43+00:00", "recorded_at": "2026-08-23T01:00:02+00:00", "last_seen_at": "2026-08-21T00:00:00+00:00", "first_seen_at": "2026-08-02T17:00:43+00:00"}, "scope": {"notes": "Affected: FlowiseAI / Flowise | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-21: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "FlowiseAI", "30d_avg": 0, "90d_avg": 0, "product": "Flowise", "cisa_kev": "no", "connections": 1, "observation_date": "2026-08-21", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-71324", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71324"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "36a7b188-023e-4ccb-811d-0386bd07e60e", "vulnerability": {"vulnId": "CVE-2026-3836", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "36a7b188-023e-4ccb-811d-0386bd07e60e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-31T22:07:41+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-31T22:07:41+00:00"}, "scope": {"notes": "Affected: fohrloop / fohrloop dash-uploader | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 35", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "fohrloop", "30d_avg": 0, "90d_avg": 0, "product": "fohrloop dash-uploader", "cisa_kev": "no", "connections": 35, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-3836", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3836"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d87450ae-82dd-448e-9359-118dcfe96f7f", "vulnerability": {"vulnId": "CVE-2026-59800", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d87450ae-82dd-448e-9359-118dcfe96f7f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-02T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-31T07:42:30+00:00", "recorded_at": "2026-08-04T01:00:01+00:00", "last_seen_at": "2026-08-02T00:00:00+00:00", "first_seen_at": "2026-07-31T07:42:30+00:00"}, "scope": {"notes": "Affected: decolua / 9router | Class: ai-system | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-02: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 0, "vendor": "decolua", "30d_avg": 0, "90d_avg": 0, "product": "9router", "cisa_kev": "no", "connections": 2, "observation_date": "2026-08-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-59800", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59800"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0004dd6f-7447-48d7-9697-b038101319ed", "vulnerability": {"vulnId": "CVE-2025-68493", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "0004dd6f-7447-48d7-9697-b038101319ed"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-31T00:00:00+00:00"}, "characteristics": {"severity": 81}, "timestamps": {"asserted_at": "2026-07-20T06:26:44+00:00", "recorded_at": "2026-09-02T01:00:02+00:00", "last_seen_at": "2026-08-31T00:00:00+00:00", "first_seen_at": "2026-07-20T06:26:44+00:00"}, "scope": {"notes": "Affected: Apache / Struts | Class: web-app-framework | Severity: High (CVSS 8.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-08-31: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Struts", "cisa_kev": "no", "connections": 2, "observation_date": "2026-08-31", "vulnerability_class": "CVSS", "vulnerability_score": 8.1, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-68493", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68493"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "bfd1a0c4-48f6-4757-a7bc-3e4baf8b8c75", "vulnerability": {"vulnId": "CVE-2026-22679", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "bfd1a0c4-48f6-4757-a7bc-3e4baf8b8c75"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-19T08:18:07+00:00", "recorded_at": "2026-09-06T01:00:01+00:00", "last_seen_at": "2026-09-04T00:00:00+00:00", "first_seen_at": "2026-07-19T08:18:07+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-04: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-22679", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22679"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "57b17216-23d1-4ead-920b-5617c2c6fe32", "vulnerability": {"vulnId": "CVE-2024-29972", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "57b17216-23d1-4ead-920b-5617c2c6fe32"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-14T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-13T10:29:05+00:00", "recorded_at": "2026-07-16T01:00:02+00:00", "last_seen_at": "2026-07-14T00:00:00+00:00", "first_seen_at": "2026-07-13T10:29:05+00:00"}, "scope": {"notes": "Affected: Zyxel / Zyxel NAS326 and NAS542 | Class: nas | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-14: 1585", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "5", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "nas", "7d_avg": 0, "vendor": "Zyxel", "30d_avg": 0, "90d_avg": 0, "product": "Zyxel NAS326 and NAS542", "cisa_kev": "no", "connections": 1585, "observation_date": "2026-07-14", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2024-29972", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29972"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "aaaf0e09-4f35-4fdb-b7e0-a8e83eff6184", "vulnerability": {"vulnId": "CVE-2026-5027", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "aaaf0e09-4f35-4fdb-b7e0-a8e83eff6184"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T15:37:40+00:00"}, "timestamps": {"asserted_at": "2026-07-10T15:37:40+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T15:37:40+00:00", "first_seen_at": "2026-07-10T15:37:40+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2026-5027", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5027"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "af31301a-0a72-4092-b26f-5e6609d336f9", "vulnerability": {"vulnId": "CVE-2026-2699", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "af31301a-0a72-4092-b26f-5e6609d336f9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-10T15:34:10+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-10T15:34:10+00:00"}, "scope": {"notes": "Affected: Progress / Citrix ShareFile StorageZones (aka storage zones) Controller | Class: file-transfer | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 196", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "19", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "file-transfer", "7d_avg": 8, "vendor": "Progress", "30d_avg": 7, "90d_avg": 3, "product": "Citrix ShareFile StorageZones (aka storage zones) Controller", "cisa_kev": "no", "connections": 196, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-2699", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2699"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "ff6a0a19-ab90-49f8-96a9-72ea9fd86b76", "vulnerability": {"vulnId": "CVE-2026-20230", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "ff6a0a19-ab90-49f8-96a9-72ea9fd86b76"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T05:44:11+00:00"}, "timestamps": {"asserted_at": "2026-07-10T05:44:11+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T05:44:11+00:00", "first_seen_at": "2026-07-10T05:44:11+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2026-20230", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20230"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b6b77f9a-166b-4e7b-bf18-313b385b9626", "vulnerability": {"vulnId": "CVE-2026-52813", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "b6b77f9a-166b-4e7b-bf18-313b385b9626"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-09T14:21:37+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2026-07-09T14:21:37+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2026-52813", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52813"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d1947506-49ef-4d01-b32b-8352660a4bbe", "vulnerability": {"vulnId": "CVE-2019-17558", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d1947506-49ef-4d01-b32b-8352660a4bbe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-31T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-07-09T09:09:09+00:00", "recorded_at": "2026-08-02T01:00:01+00:00", "last_seen_at": "2026-07-31T00:00:00+00:00", "first_seen_at": "2026-07-09T09:09:09+00:00"}, "scope": {"notes": "Affected: Apache / Solr | Class: database | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-07-31: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 0, "vendor": "Apache", "30d_avg": 0, "90d_avg": 0, "product": "Solr", "cisa_kev": "yes", "connections": 5, "observation_date": "2026-07-31", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2019-17558", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17558"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "11019423-d892-43f2-a33f-556afc545236", "vulnerability": {"vulnId": "CVE-2026-20253", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "11019423-d892-43f2-a33f-556afc545236"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-09T01:42:12+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-09T01:42:12+00:00"}, "scope": {"notes": "Affected: Splunk / Splunk | Class: database | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 37", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "database", "7d_avg": 2, "vendor": "Splunk", "30d_avg": 2, "90d_avg": 0, "product": "Splunk", "cisa_kev": "yes", "connections": 37, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-20253", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20253"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a7aa451a-f4d6-43b4-b324-e869ef8f1ee9", "vulnerability": {"vulnId": "CVE-2026-48282", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "a7aa451a-f4d6-43b4-b324-e869ef8f1ee9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-07-08T17:11:33+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-08T17:11:33+00:00"}, "scope": {"notes": "Affected: Adobe / Adobe ColdFusion | Class: app-server | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 43", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "app-server", "7d_avg": 1, "vendor": "Adobe", "30d_avg": 0, "90d_avg": 0, "product": "Adobe ColdFusion", "cisa_kev": "yes", "connections": 43, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-48282", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48282"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c942d8ec-44ff-4f7b-a511-f0cd8389289c", "vulnerability": {"vulnId": "CVE-2026-4631", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c942d8ec-44ff-4f7b-a511-f0cd8389289c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-08T12:18:53+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-08T12:18:53+00:00"}, "scope": {"notes": "Affected: Cockpit / Cockpit | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 38", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 1, "vendor": "Cockpit", "30d_avg": 0, "90d_avg": 0, "product": "Cockpit", "cisa_kev": "no", "connections": 38, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-4631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4631"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6944be1d-0993-4b99-adcc-f1e9b51106ac", "vulnerability": {"vulnId": "CVE-2023-6567", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "6944be1d-0993-4b99-adcc-f1e9b51106ac"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-09T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-08T12:10:33+00:00", "recorded_at": "2026-07-11T01:00:02+00:00", "last_seen_at": "2026-07-09T00:00:00+00:00", "first_seen_at": "2026-07-08T12:10:33+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-09: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-09", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2023-6567", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6567"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "a4801dc3-3205-446b-9c65-986cc1397de4", "vulnerability": {"vulnId": "CVE-2026-4020", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "a4801dc3-3205-446b-9c65-986cc1397de4"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-11T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-08T08:28:06+00:00", "recorded_at": "2026-07-13T01:00:02+00:00", "last_seen_at": "2026-07-11T00:00:00+00:00", "first_seen_at": "2026-07-08T08:28:06+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-11: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 2, "observation_date": "2026-07-11", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2026-4020", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4020"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fd2d0112-8dcb-4f95-af00-6070dec1ed18", "vulnerability": {"vulnId": "CVE-2026-39808", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "fd2d0112-8dcb-4f95-af00-6070dec1ed18"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-10T00:00:00+00:00"}, "timestamps": {"asserted_at": "2026-07-08T07:31:01+00:00", "recorded_at": "2026-07-12T01:00:02+00:00", "last_seen_at": "2026-07-10T00:00:00+00:00", "first_seen_at": "2026-07-08T07:31:01+00:00"}, "scope": {"notes": "IoT: no | In CISA KEV: no | Honeypot connections on 2026-07-10: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": null, "7d_avg": 0, "vendor": "", "30d_avg": 0, "90d_avg": 0, "product": "", "cisa_kev": "no", "connections": 1, "observation_date": "2026-07-10", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2026-39808", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39808"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "02e1252b-55f8-4520-90dd-ccc8756ed24b", "vulnerability": {"vulnId": "CVE-2026-8037", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "02e1252b-55f8-4520-90dd-ccc8756ed24b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-07T13:01:13+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-07T13:01:13+00:00"}, "scope": {"notes": "Affected: Progress / Kemp LoadMaster | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 38", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Progress", "30d_avg": 0, "90d_avg": 0, "product": "Kemp LoadMaster", "cisa_kev": "yes", "connections": 38, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-8037", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8037"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "29e1d8ee-0f6a-4921-8082-ea90842b66d8", "vulnerability": {"vulnId": "CVE-2026-35273", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "29e1d8ee-0f6a-4921-8082-ea90842b66d8"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-07T12:06:02+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-07T12:06:02+00:00"}, "scope": {"notes": "Affected: Oracle / PeopleSoft Enterprise PeopleTools | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 41", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "PeopleSoft Enterprise PeopleTools", "cisa_kev": "yes", "connections": 41, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-35273", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35273"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "9fd6218f-1bee-49ad-97a7-239eadb52362", "vulnerability": {"vulnId": "CVE-2023-39361", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "9fd6218f-1bee-49ad-97a7-239eadb52362"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-06T22:07:16+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-07-06T22:07:16+00:00"}, "scope": {"notes": "Affected: Cacti / Cacti | Class: network-monitoring | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 42", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "3", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "network-monitoring", "7d_avg": 2, "vendor": "Cacti", "30d_avg": 1, "90d_avg": 0, "product": "Cacti", "cisa_kev": "no", "connections": 42, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-39361", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39361"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "b3d5c2ab-0a83-4ebd-a728-113b3bfd4c26", "vulnerability": {"vulnId": "CVE-2022-50992", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "b3d5c2ab-0a83-4ebd-a728-113b3bfd4c26"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-07-06T18:39:49+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-06T18:39:49+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 8", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 4, "vendor": "Weaver", "30d_avg": 2, "90d_avg": 1, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 8, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2022-50992", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50992"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "09d80280-84d6-4d42-8b8d-c3fca98d1b85", "vulnerability": {"vulnId": "CVE-2026-34910", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "09d80280-84d6-4d42-8b8d-c3fca98d1b85"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-07-06T16:13:45+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-06T16:13:45+00:00"}, "scope": {"notes": "Affected: Ubiquiti / Ubiquiti UniFi | Class: router | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-09-07: 4", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "Ubiquiti", "30d_avg": 1, "90d_avg": 0, "product": "Ubiquiti UniFi", "cisa_kev": "yes", "connections": 4, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-34910", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34910"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "989ae670-5f47-4bb6-b2c9-ee1887d39c30", "vulnerability": {"vulnId": "CVE-2026-1207", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "989ae670-5f47-4bb6-b2c9-ee1887d39c30"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:34:45+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-06T11:34:45+00:00"}, "scope": {"notes": "Affected: Django / Django RasterField | Class: web-app-framework | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-app-framework", "7d_avg": 1, "vendor": "Django", "30d_avg": 1, "90d_avg": 0, "product": "Django RasterField", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-1207", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "651a74de-ac10-479a-8fd5-f5e9d5f9b99a", "vulnerability": {"vulnId": "CVE-2026-42271", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "651a74de-ac10-479a-8fd5-f5e9d5f9b99a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-07-06T11:17:45+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-07-06T11:17:45+00:00"}, "scope": {"notes": "Affected: LiteLLM / LiteLLM | Class: ai-system | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 47", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "46", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 49, "vendor": "LiteLLM", "30d_avg": 119, "90d_avg": 138, "product": "LiteLLM", "cisa_kev": "yes", "connections": 47, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2026-42271", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42271"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3f1f3f36-02d7-4490-8b5d-3adbf72d8a8d", "vulnerability": {"vulnId": "CVE-2026-1125", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "3f1f3f36-02d7-4490-8b5d-3adbf72d8a8d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-02T12:35:18+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-07-02T12:35:18+00:00", "recorded_at": "2026-07-04T01:00:01+00:00", "last_seen_at": "2026-07-02T12:35:18+00:00", "first_seen_at": "2026-07-02T12:35:18+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-02: 12", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "no", "connections": 12, "observation_date": "2026-07-02", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-1125", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1125"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "fe026380-c375-4ff6-b489-8b01e189972d", "vulnerability": {"vulnId": "CVE-2017-12542", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "fe026380-c375-4ff6-b489-8b01e189972d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-07-01T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-30T13:11:03+00:00", "recorded_at": "2026-07-03T01:00:01+00:00", "last_seen_at": "2026-07-01T00:00:00+00:00", "first_seen_at": "2026-06-30T13:11:03+00:00"}, "scope": {"notes": "Affected: HP / HP iLO 4 | Class: device-management-platform | Severity: Critical (CVSS 10) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-01: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "HP", "30d_avg": 0, "90d_avg": 0, "product": "HP iLO 4", "cisa_kev": "no", "connections": 5, "observation_date": "2026-07-01", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2017-12542", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12542"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "5c265b12-5dff-4259-b5e3-e0e41e2cec23", "vulnerability": {"vulnId": "CVE-2026-36356", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "5c265b12-5dff-4259-b5e3-e0e41e2cec23"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 91}, "timestamps": {"asserted_at": "2026-06-21T06:44:37+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-06-21T06:44:37+00:00"}, "scope": {"notes": "Affected: MeiG / MeiG Smart FORGE_SLT711 | Class: router | Severity: Critical (CVSS 9.1) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-07: 5", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 1, "vendor": "MeiG", "30d_avg": 0, "90d_avg": 0, "product": "MeiG Smart FORGE_SLT711", "cisa_kev": "no", "connections": 5, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.1, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-36356", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36356"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "caa5acab-bf4e-48a0-b262-1ff0097f9e2a", "vulnerability": {"vulnId": "CVE-2026-10520", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "caa5acab-bf4e-48a0-b262-1ff0097f9e2a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 100}, "timestamps": {"asserted_at": "2026-06-10T17:11:12+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-06-10T17:11:12+00:00"}, "scope": {"notes": "Affected: Ivanti / Sentry | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Ivanti", "30d_avg": 2, "90d_avg": 3, "product": "Sentry", "cisa_kev": "yes", "connections": 2, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 10, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-10520", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e1e4050c-7882-474c-9315-d5eb4fac0557", "vulnerability": {"vulnId": "CVE-2026-24423", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "e1e4050c-7882-474c-9315-d5eb4fac0557"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-06-08T12:19:21+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-06-08T12:19:21+00:00"}, "scope": {"notes": "Affected: SmarterTools / SmarterMail | Class: email | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 160", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "email", "7d_avg": 2, "vendor": "SmarterTools", "30d_avg": 1, "90d_avg": 0, "product": "SmarterMail", "cisa_kev": "yes", "connections": 160, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-24423", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24423"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "466fadcd-435f-455f-9337-b455a9eb5b6b", "vulnerability": {"vulnId": "CVE-2024-8522", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "466fadcd-435f-455f-9337-b455a9eb5b6b"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-06-08T12:12:59+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-06-08T12:12:59+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress LearnPress plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 34", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 0, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress LearnPress plugin", "cisa_kev": "no", "connections": 34, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-8522", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8522"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "07cf1779-8ae3-4cd6-9daf-0b248c4634e6", "vulnerability": {"vulnId": "CVE-2025-34033", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "07cf1779-8ae3-4cd6-9daf-0b248c4634e6"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-06-07T19:06:22+00:00"}, "timestamps": {"asserted_at": "2026-06-07T19:06:22+00:00", "recorded_at": "2026-07-01T11:42:35+00:00", "last_seen_at": "2026-06-07T19:06:22+00:00", "first_seen_at": "2026-06-07T19:06:22+00:00"}, "scope": {"notes": "Affected: 5VTechnologies / Blue Angel Software Suite | Class: security-management-platform | IoT: no | In CISA KEV: no | Honeypot connections on 2026-06-07: 300", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "security-management-platform", "7d_avg": 0, "vendor": "5VTechnologies", "30d_avg": 0, "90d_avg": 0, "product": "Blue Angel Software Suite", "cisa_kev": "no", "connections": 300, "observation_date": "2026-06-07", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34033", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34033"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c7d75b0f-13f0-40e3-9c35-b716cb041e9f", "vulnerability": {"vulnId": "CVE-2020-9314", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c7d75b0f-13f0-40e3-9c35-b716cb041e9f"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-01T00:00:00+00:00"}, "characteristics": {"severity": 48}, "timestamps": {"asserted_at": "2026-05-16T21:20:08+00:00", "recorded_at": "2026-09-03T01:00:01+00:00", "last_seen_at": "2026-09-01T00:00:00+00:00", "first_seen_at": "2026-05-16T21:20:08+00:00"}, "scope": {"notes": "Affected: Oracle / Oracle iPlanet Web Server | Class: web-server | Severity: Medium (CVSS 4.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-01: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "web-server", "7d_avg": 0, "vendor": "Oracle", "30d_avg": 0, "90d_avg": 0, "product": "Oracle iPlanet Web Server", "cisa_kev": "no", "connections": 3, "observation_date": "2026-09-01", "vulnerability_class": "CVSS", "vulnerability_score": 4.8, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2020-9314", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9314"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "6f426504-481c-43c6-a156-bf80dd57c746", "vulnerability": {"vulnId": "CVE-2025-67303", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "6f426504-481c-43c6-a156-bf80dd57c746"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:51:35+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-16T15:51:35+00:00"}, "scope": {"notes": "Affected: Comfy Org / ComfyUI-Manager | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 41", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Comfy Org", "30d_avg": 0, "90d_avg": 2, "product": "ComfyUI-Manager", "cisa_kev": "no", "connections": 41, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-67303", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67303"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "7cd2b97f-5b5c-45c2-b132-69f3d1c971f7", "vulnerability": {"vulnId": "CVE-2024-45309", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "7cd2b97f-5b5c-45c2-b132-69f3d1c971f7"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-16T15:14:18+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-16T15:14:18+00:00"}, "scope": {"notes": "Affected: OneDev / OneDev | Class: other-software | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 35", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "OneDev", "30d_avg": 0, "90d_avg": 2, "product": "OneDev", "cisa_kev": "no", "connections": 35, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2024-45309", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45309"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "645b4732-067e-4a76-9b00-a458d4329323", "vulnerability": {"vulnId": "CVE-2022-28290", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "645b4732-067e-4a76-9b00-a458d4329323"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-05T00:00:00+00:00"}, "characteristics": {"severity": 61}, "timestamps": {"asserted_at": "2026-05-16T10:01:07+00:00", "recorded_at": "2026-09-07T01:00:02+00:00", "last_seen_at": "2026-09-05T00:00:00+00:00", "first_seen_at": "2026-05-16T10:01:07+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Country Selector plugin | Class: cms | Severity: Medium (CVSS 6.1) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-05: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 0, "product": "Wordpress Country Selector plugin", "cisa_kev": "no", "connections": 2, "observation_date": "2026-09-05", "vulnerability_class": "CVSS", "vulnerability_score": 6.1, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2022-28290", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28290"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "65a133f1-2f3c-40fa-89f1-76f23603321e", "vulnerability": {"vulnId": "CVE-2021-22054", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "65a133f1-2f3c-40fa-89f1-76f23603321e"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-17T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-15T15:16:56+00:00", "recorded_at": "2026-08-19T01:00:02+00:00", "last_seen_at": "2026-08-17T00:00:00+00:00", "first_seen_at": "2026-05-15T15:16:56+00:00"}, "scope": {"notes": "Affected: Omnissa / Omnissa Workspace ONE UEM | Class: device-management-platform | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-08-17: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Omnissa", "30d_avg": 0, "90d_avg": 0, "product": "Omnissa Workspace ONE UEM", "cisa_kev": "yes", "connections": 1, "observation_date": "2026-08-17", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-22054", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22054"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2ad2e93e-c224-45d0-99f8-275257fa12fe", "vulnerability": {"vulnId": "CVE-2022-50993", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "2ad2e93e-c224-45d0-99f8-275257fa12fe"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:44+00:00", "recorded_at": "2026-09-06T01:00:01+00:00", "last_seen_at": "2026-09-04T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:44+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-04: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-Office", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-50993", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50993"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "c45fb8ed-e753-4d21-8594-6491bad37976", "vulnerability": {"vulnId": "CVE-2025-71284", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "c45fb8ed-e753-4d21-8594-6491bad37976"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-15T14:34:17+00:00", "recorded_at": "2026-09-06T01:00:01+00:00", "last_seen_at": "2026-09-04T00:00:00+00:00", "first_seen_at": "2026-05-15T14:34:17+00:00"}, "scope": {"notes": "Affected: Synway Information Engineering / Synway SMG Gateway Management Software | Class: device-management-platform | Severity: Critical (CVSS 9.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-09-04: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "device-management-platform", "7d_avg": 0, "vendor": "Synway Information Engineering", "30d_avg": 0, "90d_avg": 0, "product": "Synway SMG Gateway Management Software", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2025-71284", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71284"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "f1bf7728-5697-4ef0-bf87-6e46b8f2e37c", "vulnerability": {"vulnId": "CVE-2023-2523", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "f1bf7728-5697-4ef0-bf87-6e46b8f2e37c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-04T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:12:02+00:00", "recorded_at": "2026-09-06T01:00:01+00:00", "last_seen_at": "2026-09-04T00:00:00+00:00", "first_seen_at": "2026-05-13T13:12:02+00:00"}, "scope": {"notes": "Affected: Weaver / Weave E-Office | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-04: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weave E-Office", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-04", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-2523", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2523"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "d451776f-25e5-4c7f-bc0f-fc957d075a48", "vulnerability": {"vulnId": "CVE-2026-41176", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "d451776f-25e5-4c7f-bc0f-fc957d075a48"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-05-13T13:00:00+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-13T13:00:00+00:00"}, "scope": {"notes": "Affected: Rclone / Rclone | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 40", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Rclone", "30d_avg": 0, "90d_avg": 2, "product": "Rclone", "cisa_kev": "no", "connections": 40, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-41176", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41176"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "e6a09b04-dff7-4f1c-ac4b-09b604b41d19", "vulnerability": {"vulnId": "CVE-2019-13396", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "e6a09b04-dff7-4f1c-ac4b-09b604b41d19"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-11T14:26:48+00:00"}, "characteristics": {"severity": 53}, "timestamps": {"asserted_at": "2026-05-11T14:26:48+00:00", "recorded_at": "2026-07-01T11:42:35+00:00", "last_seen_at": "2026-05-11T14:26:48+00:00", "first_seen_at": "2026-05-11T14:26:48+00:00"}, "scope": {"notes": "Affected: FlightPath / FlightPath | Class: other-software | Severity: Medium (CVSS 5.3) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-11: 2", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "FlightPath", "30d_avg": 0, "90d_avg": 0, "product": "FlightPath", "cisa_kev": "no", "connections": 2, "observation_date": "2026-05-11", "vulnerability_class": "CVSS", "vulnerability_score": 5.3, "vulnerability_severity": "Medium"}}], "references": [{"id": "CVE-2019-13396", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13396"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3c9bad09-d0d8-4160-86e5-df6a3a96b573", "vulnerability": {"vulnId": "CVE-2020-1956", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "3c9bad09-d0d8-4160-86e5-df6a3a96b573"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 88}, "timestamps": {"asserted_at": "2026-05-11T07:31:41+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-11T07:31:41+00:00"}, "scope": {"notes": "Affected: Apache / Apache Kylin | Class: other-software | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 85", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 1, "vendor": "Apache", "30d_avg": 1, "90d_avg": 2, "product": "Apache Kylin", "cisa_kev": "yes", "connections": 85, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 8.8, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2020-1956", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1956"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "4b86132c-02fd-4a2f-8f7f-a02b59b5f821", "vulnerability": {"vulnId": "CVE-2025-34058", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "4b86132c-02fd-4a2f-8f7f-a02b59b5f821"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-05-03T16:22:57+00:00"}, "timestamps": {"asserted_at": "2026-05-03T16:22:57+00:00", "recorded_at": "2026-07-01T11:42:35+00:00", "last_seen_at": "2026-05-03T16:22:57+00:00", "first_seen_at": "2026-05-03T16:22:57+00:00"}, "scope": {"notes": "Affected: Hikvision / Hikvision Streaming Media Management Server | Class: other-software | IoT: no | In CISA KEV: no | Honeypot connections on 2026-05-03: 3", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Hikvision", "30d_avg": 0, "90d_avg": 0, "product": "Hikvision Streaming Media Management Server", "cisa_kev": "no", "connections": 3, "observation_date": "2026-05-03", "vulnerability_class": null, "vulnerability_score": null, "vulnerability_severity": null}}], "references": [{"id": "CVE-2025-34058", "url": "https://www.cve.org/CVERecord?id=CVE-2025-34058"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "66eb5610-e5cd-4679-b918-8dc27dd25083", "vulnerability": {"vulnId": "CVE-2023-6266", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "66eb5610-e5cd-4679-b918-8dc27dd25083"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T18:17:15+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-01T18:17:15+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Backup Migration plugin | Class: cms | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 18", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 0, "90d_avg": 1, "product": "Wordpress Backup Migration plugin", "cisa_kev": "no", "connections": 18, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-6266", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6266"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "2acffa01-35f3-454a-99cc-a856be6f2fe9", "vulnerability": {"vulnId": "CVE-2021-27358", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "2acffa01-35f3-454a-99cc-a856be6f2fe9"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-05-01T17:07:58+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-05-01T17:07:58+00:00"}, "scope": {"notes": "Affected: Grafana / Grafana | Class: data-visualization | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 34", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "data-visualization", "7d_avg": 3, "vendor": "Grafana", "30d_avg": 1, "90d_avg": 2, "product": "Grafana", "cisa_kev": "no", "connections": 34, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2021-27358", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27358"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "8d22024b-e155-4586-8605-f179ef65516d", "vulnerability": {"vulnId": "CVE-2023-6909", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "8d22024b-e155-4586-8605-f179ef65516d"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 75}, "timestamps": {"asserted_at": "2026-04-30T18:23:58+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-04-30T18:23:58+00:00"}, "scope": {"notes": "Affected: MLflow / MLflow | Class: ai-system | Severity: High (CVSS 7.5) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 99", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "4", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "ai-system", "7d_avg": 1, "vendor": "MLflow", "30d_avg": 0, "90d_avg": 8, "product": "MLflow", "cisa_kev": "no", "connections": 99, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.5, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2023-6909", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6909"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "0b1130b7-b10a-4d31-aac7-594f67a11862", "vulnerability": {"vulnId": "CVE-2022-4059", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "0b1130b7-b10a-4d31-aac7-594f67a11862"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T15:35:33+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-04-30T15:35:33+00:00"}, "scope": {"notes": "Affected: Wordpress / Wordpress Cryptocurrency Widgets Pack plugin | Class: cms | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 32", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "2", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "cms", "7d_avg": 1, "vendor": "Wordpress", "30d_avg": 1, "90d_avg": 3, "product": "Wordpress Cryptocurrency Widgets Pack plugin", "cisa_kev": "no", "connections": 32, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2022-4059", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4059"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "21a8978a-21e0-4be3-89e6-345fd2fb9409", "vulnerability": {"vulnId": "CVE-2026-41940", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "21a8978a-21e0-4be3-89e6-345fd2fb9409"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-07T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-30T13:55:53+00:00", "recorded_at": "2026-09-09T01:00:01+00:00", "last_seen_at": "2026-09-07T00:00:00+00:00", "first_seen_at": "2026-04-30T13:55:53+00:00"}, "scope": {"notes": "Affected: cPanel / cPanel and WHM | Class: remote-access | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 851", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "76", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "remote-access", "7d_avg": 96, "vendor": "cPanel", "30d_avg": 93, "90d_avg": 181, "product": "cPanel and WHM", "cisa_kev": "yes", "connections": 851, "observation_date": "2026-09-07", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2026-41940", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41940"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "525cfe08-a745-4ec2-9c16-5b76c7dc0f41", "vulnerability": {"vulnId": "CVE-2025-29635", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "525cfe08-a745-4ec2-9c16-5b76c7dc0f41"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 72}, "timestamps": {"asserted_at": "2026-04-27T01:02:53+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-04-27T01:02:53+00:00"}, "scope": {"notes": "Affected: D-Link / D-Link DIR-823X | Class: router | Severity: High (CVSS 7.2) | IoT: yes | In CISA KEV: yes | Honeypot connections on 2026-09-06: 7", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "yes", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "router", "7d_avg": 0, "vendor": "D-Link", "30d_avg": 0, "90d_avg": 0, "product": "D-Link DIR-823X", "cisa_kev": "yes", "connections": 7, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 7.2, "vulnerability_severity": "High"}}], "references": [{"id": "CVE-2025-29635", "url": "https://www.cve.org/CVERecord?id=CVE-2025-29635"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}, {"uuid": "3cb4c8a6-94b8-42f3-beaa-028790aa7528", "vulnerability": {"vulnId": "CVE-2023-3793", "altId": []}, "gcve": {"origin_uuid": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "object_uuid": "3cb4c8a6-94b8-42f3-beaa-028790aa7528"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-09-06T00:00:00+00:00"}, "characteristics": {"severity": 98}, "timestamps": {"asserted_at": "2026-04-26T02:13:53+00:00", "recorded_at": "2026-09-08T01:00:01+00:00", "last_seen_at": "2026-09-06T00:00:00+00:00", "first_seen_at": "2026-04-26T02:13:53+00:00"}, "scope": {"notes": "Affected: Weaver / Weaver E-cology | Class: other-software | Severity: Critical (CVSS 9.8) | IoT: no | In CISA KEV: no | Honeypot connections on 2026-09-06: 1", "asset_exposure": ["internet-facing"]}, "evidence": [{"type": "honeypot", "source": "shadowserver", "signal": "in_the_wild_attempts", "confidence": 0.7, "details": {"1d": "1", "iot": "no", "feed": "Shadowserver Foundation honeypot/exploited-vulnerabilities", "type": "http-scan", "class": "other-software", "7d_avg": 0, "vendor": "Weaver", "30d_avg": 0, "90d_avg": 0, "product": "Weaver E-cology", "cisa_kev": "no", "connections": 1, "observation_date": "2026-09-06", "vulnerability_class": "CVSS", "vulnerability_score": 9.8, "vulnerability_severity": "Critical"}}], "references": [{"id": "CVE-2023-3793", "url": "https://www.cve.org/CVERecord?id=CVE-2023-3793"}, {"id": "shadowserver", "url": "https://www.shadowserver.org/what-we-do/network-reporting/honeypot-exploited-vulnerabilities-report/"}]}]}