Latest Updates

Managing vulnerabilities at scale is something the entire cybersecurity ecosystem has struggled with for a long time.

VulnCheck scans the Go module ecosystem for module repositories affected by repojacking, and discover hundreds of thousands of affected module-versions.

VulnCheck finds a new way to exploit ActiveMQ CVE-2023-46604 that allows the attacker to hide in memory and avoid process-based detections.

VulnCheck scanned the internet for implanted Cisco IOS XE systems and found thousands of results.

VulnCheck was excited to breach ICS networks when CVE-2023-43261 was first disclosed. However, there is more to this than the CVE description would lead you to believe. Follow VulnCheck’s journey from CVE description to exploitation in the wild

VulnCheck is excited to announce four new leadership team additions!

Learn about VulnCheck's development of an exploit for CVE-2023-36845, leading to stealthy code execution on Juniper firewalls, while also assessing the prevalence of unpatched systems in the wild.

VulnCheck demonstrates the use of the RocketMQ remoting protocol to retrieve the broker configuration file, and shares attacker payloads used in the wild for exploitation with CVE-2023-33246.

CVE-2023-32315 was first exploited in the wild in June 2023. However, VulnCheck has discovered an new approach to exploiting this vulnerability, streamlining the attack process and adeptly bypassing the generation of log entries. In addition, VulnCheck analyzes the remaining indicators of compromise and shares network detections.

VulnCheck provides additional insight into CISA's 2022 Top Routinely Exploited Vulnerabilities by looking at the availability of exploits and examining which threat actors, botnets, and ransomware crews used the vulnerabilities.

VulnCheck develops an exploit that gets a root shell on MikroTik RouterOS.

VulnCheck analyzes four CVEs that impact SolarView, a solar power monitoring system. We discover the number of internet-facing systems and the likelihood of exploitation in the wild.

VulnCheck discovers a network of fake security researcher accounts promoting hidden malware.

VulnCheck is excited to announce the open-source release of our in-house exploit framework, go-exploit. Designed with simplicity and portability in mind, go-exploit empowers exploit developers to create compact, self-contained, and consistent exploits.

Public exploits and detections for CVE-2023-27350 focus on code execution using the PaperCut print scripting interface. In this blog, VulnCheck shares a new code execution vector and demonstrates how existing detections aren't robust enough to flag the new activity.

CVE-2023-1671 is a pre-authenticated command injection in Sophos Web Appliance. In this blog post, VulnCheck researchers analyze the vulnerability and develop a proof of concept (PoC) for it.

In search of an interesting new detail about CVE-2022-1388, VulnCheck researchers pore over open source intelligence. The researchers detail exploit variants, find signature bypasses, and publish a novel exploit variant.

Following reader suggestions, we take a deeper look at the types of vulnerabilities in the Exploit-DB and 0day.today exploit databases. We also examine exploit attack vectors and find out how many of the exploits have been used in the wild.

Exploit-DB and 0day.today are two of the largest public exploit databases. In this blog, we compare the databases to determine which one is the most relevant today.

CVE-2023-23752 is an information leak affecting Joomla! 4.0 - 4.7. How can an attacker use this vulnerability to achieve code execution? How many internet-facing systems are at risk?

A review of the vulnerabilities that should have been added to the CISA KEV Catalog in 2022, but weren't.

A review of the vulnerabilities added to the CISA KEV Catalog in 2022. VulnCheck examines which vulnerabilities were added in 2022, who exploited them, and how long it took to add them to the Catalog.

Examining previous exploits for Grafana's CVE-2021-43798 and looking for a path to establish initial access.

Exploring a memory resident payload for CVE-2022-47966.

The National Vulnerability Database contains thousands of CVSS vectors. How accurate are those vectors and does accuracy matter?

Sophos Firewalls were exploited using CVE-2022-3236 in September, 2022. Few details have been published about this vulnerability. In this blog, we look at log entries the exploit creates and determine how many vulnerable internet-facing firewalls still exist.

Taking a look at the timeline leading up to exploitation of CVE-2022-35914 and the current state of attacks in the wild.

An investigation into CVE-2022-28958 finds the vulnerability doesn't actually exist.

An examination of vulnerabilities affecting Xiongmai IoT devices, including exploit development and an analysis of exploitation in the wild.

The CISA Known Exploited Vulnerabilities (KEV) Catalog tracks vulnerabilities that have been exploited in the wild, and it currently has more than 800 entries.

We've been around, supporting our customers since 2021, but only recently launched our website.