phishing abuses RMM tools

Phishing Abuses RMM Tools for Persistent Network Access CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

Phishing Abuses RMM Tools for Persistent Network Access

Do Son October 2, 2026

At a Glance Summary Attribute Details Actor or Group Unattributed cybercrime operators Activity Type Phishing, dual RMM...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2017-20287CVSS 8.7
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2017-20288CVSS 5.1
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2017-20289CVSS 7.7
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 23, 2026
CVE-2026-114625CVSS 9.9
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intel📅 Updated: Oct 22, 2026
CVE-2026-109619CVSS 9.2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not...
Admin intel📅 Updated: Oct 22, 2026

CVE-2026-111811CVSS 9.4
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache....
📅 Updated: Oct 22, 2026
CVE-2025-31699CVSS 9.1
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting...
📅 Updated: Oct 22, 2026
CVE-2026-111813CVSS 10.0
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned)...
📅 Updated: Oct 22, 2026
CVE-2026-97785CVSS 10.0
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
📅 Updated: Oct 22, 2026
CVE-2026-83938CVSS 10.0
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over...
📅 Updated: Oct 22, 2026
CVE-2026-110063CVSS 10.0
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized...
📅 Updated: Oct 22, 2026
CVE-2026-105016CVSS 9.8
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
📅 Updated: Oct 22, 2026
CVE-2026-105014CVSS 9.1
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker...
📅 Updated: Oct 22, 2026