● Threat Intelligence Report

Generated 2026-07-20 22:01 UTC  ·  3/3 sources live  ·  ← back to cyberassist
↻ Refresh⇩ Download PDF
1647
KEV catalog total
9
Added last 7 days
329
Ransomware-linked
35
Fresh IOCs / pulses

Latest CISA Known Exploited Vulnerabilities live

CVEVendor / ProductVulnerabilityAddedDue
CVE-2026-58644Microsoft
SharePoint		Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-162026-07-19
CVE-2026-25089Fortinet
FortiSandbox		Fortinet FortiSandbox OS Command Injection Vulnerability2026-07-162026-07-19
CVE-2026-39808Fortinet
FortiSandbox		Fortinet FortiSandbox OS Command Injection Vulnerability2026-07-162026-07-19
CVE-2026-46817Oracle
E-Business Suite		Oracle E-Business Suite Improper Privilege Management Vulnerability2026-07-152026-07-18
CVE-2023-4346KNX Association
KNX Protocol Connection Authorization Option 1		KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability2026-07-152026-07-29
CVE-2026-56155Microsoft
Active Directory Federation Services		Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability 2026-07-142026-07-28
CVE-2026-56164Microsoft
SharePoint Server		Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability2026-07-142026-07-17
CVE-2026-15409SonicWall
SMA1000 Appliances		SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability2026-07-142026-07-17
CVE-2026-15410SonicWall
SMA1000 Appliances		SonicWall SMA1000 Appliances Code Injection Vulnerability2026-07-142026-07-17
CVE-2008-4128Cisco
IOS		Cisco IOS Cross-Site Request Forgery Vulnerability2026-07-132026-07-16
CVE-2026-56291Balbooa
Forms		Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-102026-07-13
CVE-2026-48939iCagenda
iCagenda		iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-102026-07-13
CVE-2026-48908JoomShaper
SP Page Builder		JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability2026-07-072026-07-10
CVE-2026-55255Langflow
Langflow		Langflow Authorization Bypass Through User-Controlled Key Vulnerability2026-07-072026-07-10
CVE-2026-56290Joomlack
Page Builder		Joomlack Page Builder Improper Access Control Vulnerability2026-07-072026-07-10
CVE-2026-48282Adobe
ColdFusion		Adobe ColdFusion Path Traversal Vulnerability2026-07-072026-07-10
CVE-2026-45659Microsoft
SharePoint Server		Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability2026-07-012026-07-04
CVE-2026-48558SimpleHelp
SimpleHelp		SimpleHelp Authentication Bypass Vulnerability2026-06-292026-07-02
CVE-2026-12569PTC
Windchill and FlexPLM		PTC Windchill and FlexPLM Improper Input Validation Vulnerability2026-06-252026-06-28
CVE-2026-20230Cisco
Unified Communications Manager		Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability2026-06-252026-06-28
CVE-2025-67038Lantronix
EDS5000		Lantronix EDS5000 Code Injection Vulnerability2026-06-232026-06-26
CVE-2026-34910Ubiquiti
UniFi OS		Ubiquiti UniFi OS Improper Input Validation Vulnerability2026-06-232026-06-26
CVE-2026-34909Ubiquiti
UniFi OS		Ubiquiti UniFi OS Path Traversal Vulnerability2026-06-232026-06-26
CVE-2026-34908Ubiquiti
UniFi OS		Ubiquiti UniFi OS Improper Access Control Vulnerability2026-06-232026-06-26
CVE-2026-20253Splunk
Enterprise		Splunk Enterprise Missing Authentication for Critical Function Vulnerability2026-06-182026-06-21

Recent Malware IOCs — ThreatFox live

IndicatorTypeMalwareThreatConf.First seen
149.28.128.253:34567ip:portAisurubotnet_cc100%2026-07-20 21:56:30 UTC
hometwfrbas.comdomainUnknown malwarepayload_delivery70%2026-07-20 21:42:30 UTC
64.52.80.235:80ip:portUnknown malwarepayload_delivery70%2026-07-20 21:42:22 UTC
wakgo.jbgroup21.comdomainClearFakepayload_delivery100%2026-07-20 21:40:27 UTC
zztz.jetourmexico.comdomainClearFakepayload_delivery100%2026-07-20 21:27:10 UTC
206.166.251.123:8591ip:portUnknown malwarebotnet_cc70%2026-07-20 21:21:00 UTC
45.76.182.55:8001ip:portAisurubotnet_cc100%2026-07-20 21:18:00 UTC
117.72.175.125:8090ip:portCobalt Strikebotnet_cc100%2026-07-20 21:05:09 UTC
154.12.86.154:33306ip:portCobalt Strikebotnet_cc100%2026-07-20 21:05:08 UTC
117.72.178.246:8081ip:portCobalt Strikebotnet_cc100%2026-07-20 21:05:07 UTC
117.72.178.246:6379ip:portCobalt Strikebotnet_cc100%2026-07-20 21:05:07 UTC
15.235.3.224:443ip:portAdaptixC2botnet_cc100%2026-07-20 21:05:05 UTC
http://162.33.178.68/msedge.txturlUnknown malwarepayload_delivery80%2026-07-20 21:01:16 UTC
149.56.12.51:443ip:portUnknown malwarebotnet_cc75%2026-07-20 21:01:07 UTC
162.33.178.68:80ip:portUnknown malwarebotnet_cc75%2026-07-20 21:01:07 UTC
testewin.comdomainUnknown malwarebotnet_cc75%2026-07-20 21:00:58 UTC
https://theprosperinghouse.com/urlUnknown malwarepayload_delivery90%2026-07-20 21:00:37 UTC
https://theholecompany.net/urlUnknown malwarepayload_delivery90%2026-07-20 21:00:37 UTC
http://193.149.187.77/urlUnknown malwarepayload_delivery75%2026-07-20 20:51:12 UTC
193.149.187.77:80ip:portUnknown malwarepayload_delivery75%2026-07-20 20:51:07 UTC
txvii.hazaratbet.betdomainClearFakepayload_delivery100%2026-07-20 20:37:24 UTC
syshash4392.topdomainMintsLoaderbotnet_cc75%2026-07-20 20:30:12 UTC
logintrust5845.loldomainMintsLoaderbotnet_cc75%2026-07-20 20:30:12 UTC
basehex1267.topdomainMintsLoaderbotnet_cc75%2026-07-20 20:30:11 UTC
1629bqt9p34elwv.topdomainMintsLoaderbotnet_cc75%2026-07-20 20:30:11 UTC

Community Threat Pulses — AlienVault OTX live

PulseAuthorTagsIOCsCreated
Still Circling: Toolkit Keeps EvolvingAlienVaulthvnc, njrat, banking fraud, vbscript dropper, asyncrat, limerat, process injection, apt-c-3662026-07-18
Unpacking "Cruciferra": An Analysis of a Sophisticated Crypter ServiceAlienVaultadaptixc2, defense-evasion, darkcloud stealer, malware-as-a-service, formbook, winos4.0, crypter-service, xworm802026-07-20
Vishing actors target Entra passkey enrollmentAlienVaultpasskey enrollment, pink dls, vishing, phone-based social engineering, data extortion, operator-controlled phishing, microsoft entra62026-07-10
Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left BehindAlienVaultvpn compromise, hash cracking, fortibleed, hashtopolis, fortigate, initial access broker, fortinet, credential harvesting02026-06-19
Operation Poisson – Analyzing a Cybercriminal’s Entire OperationAlienVaulttailscale, rustdesk, poisson, credential-theft, france, keylogger, fileless-attack, openssh112026-06-19
Popa: From Sourcing to DistributionAlienVaultresidential proxy, netnut, neupop, sdk, moneytiser, hopanet, popa, loopop2112026-06-18
Klue Integration Abused in Salesforce Data Theft | Threat SpotlightAlienVaultsalesforce, unc6395, oauth abuse, api exfiltration, third-party integration, klue integration, shinyhunters, crm data theft02026-06-18
Botnet Analysis: A Product-Grade Threat for the AI Service EraAlienVaultshodan intelligence, credential harvesting, polymorphic, ai infrastructure targeting, mcp exploitation, botnet, autonomous scanning, go-based62026-07-17
Contagious Interview malware in SVG images: DPRK campaignAlienVaultdeveloper targeting, cryptocurrency wallet theft, supply chain attack, svg, ottercookie, steganography, fake job interviews, beavertail132026-07-17
Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection ChainAlienVaultbitmap steganography, fileless execution, multi-stage loader, dynamic dns, india targeting, credential theft, gst phishing, remcos rat62026-07-17