Do Son GreyNoise observed a sudden, coordinated surge of 110 unique IPs exploiting the Grafana path traversal flaw (CVE-2021-43798), targeting only the US, Slovakia, and Taiwan.
exploitation
CISA adds three D-Link vulnerabilities (CVE-2020-25078, -25079, -2022-40799) to its KEV Catalog, confirming active exploitation of EOL IP cameras.
A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.
A critical SharePoint Server RCE (CVE-2025-53770) is actively exploited. A Metasploit module is now public, amplifying the urgency for immediate patching.
Microsoft warns that China-backed APTs (Linen Typhoon, Violet Typhoon, Storm-2603) are actively exploiting critical SharePoint zero-days (CVE-2025-49704, -49706) in unpatched on-premises servers.
Cisco warns of active exploitation for three critical ISE flaws (CVSS 10.0), allowing unauthenticated RCE and full system control. Update ISE 3.3 and 3.4 immediately!
An unauthenticated SharePoint RCE chain dubbed ToolShell (CVE-2025-49704, CVE-2025-49706) is being actively exploited globally, granting attackers full control of on-premise servers.
Microsoft warns of active zero-day exploitation (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint Server. No patch is available, but mitigations are provided.
CrushFTP has issued an urgent advisory for CVE-2025-54309, a critical zero-day allowing remote exploitation via HTTP(S), already being actively used in the wild.
FortiGuard Labs exposes RondoDox, a stealthy botnet exploiting critical flaws (CVE-2024-3721, CVE-2024-12856) in TBK DVRs & Four-Faith routers to launch sophisticated DDoS attacks.
CISA adds 3 actively exploited Qualcomm Adreno GPU flaws to KEV catalog. Android devices at risk from memory corruption and use-after-free bugs.
CISA adds 5 new exploited vulnerabilities to KEV, including flaws in ASUS routers, Craft CMS, and ConnectWise. Urgent patching required!
CISA issues urgent alert on actively exploited SonicWall SMA100 vulnerability (CVE-2021-20035). Federal agencies must mitigate by May 7, 2025
Learn about the new Linux kernel exploit called SLUBStick and how it could empower attackers to gain complete control over a system.
The active exploitation of CVE-2024-29973 by a Mirai-like botnet underscores the urgency of applying the necessary security patches
GreyNoise, a cybersecurity agency, has observed mass exploitation of the CVE-2023-49103 vulnerability as early as November 25, 2023