Datasets:
instruction stringclasses 12
values | input stringlengths 83 6.28k | output stringlengths 253 4.94k | tags listlengths 0 19 | meta unknown |
|---|---|---|---|---|
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-42897
Vendor: Microsoft
Product: Microsoft
Name: Microsoft Exchange Server Cross-Site Scripting Vulnerability
CISA KEV added: 2026-05-15
Known ransomware use: Unknown
CWEs: CWE-79
Description: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web... | ## Why this CVE matters right now
- `CVE-2026-42897` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-15).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"XSS"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-42897",
"vendor": "Microsoft",
"product": "Microsoft"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20182
Vendor: Cisco
Product: Catalyst SD-WAN
Name: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CISA KEV added: 2026-05-14
Known ransomware use: Unknown
CWEs: CWE-287
Description: Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows ... | ## Why this CVE matters right now
- `CVE-2026-20182` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-14).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20182",
"vendor": "Cisco",
"product": "Catalyst SD-WAN"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-42208
Vendor: BerriAI
Product: LiteLLM
Name: BerriAI LiteLLM SQL Injection Vulnerability
CISA KEV added: 2026-05-08
Known ransomware use: Unknown
CWEs: CWE-89
Description: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially ... | ## Why this CVE matters right now
- `CVE-2026-42208` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-08).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"SQLi"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-42208",
"vendor": "BerriAI",
"product": "LiteLLM"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-6973
Vendor: Ivanti
Product: Endpoint Manager Mobile (EPMM)
Name: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
CISA KEV added: 2026-05-07
Known ransomware use: Unknown
CWEs: CWE-20
Description: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vul... | ## Why this CVE matters right now
- `CVE-2026-6973` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-07).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `E... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-6973",
"vendor": "Ivanti",
"product": "Endpoint Manager Mobile (EPMM)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-0300
Vendor: Palo Alto Networks
Product: PAN-OS
Name: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
CISA KEV added: 2026-05-06
Known ransomware use: Unknown
CWEs: CWE-787
Description: Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal... | ## Why this CVE matters right now
- `CVE-2026-0300` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-06).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `P... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-0300",
"vendor": "Palo Alto Networks",
"product": "PAN-OS"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-31431
Vendor: Linux
Product: Kernel
Name: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
CISA KEV added: 2026-05-01
Known ransomware use: Unknown
CWEs: CWE-669
Description: Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privi... | ## Why this CVE matters right now
- `CVE-2026-31431` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-05-01).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-31431",
"vendor": "Linux",
"product": "Kernel"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-41940
Vendor: WebPros
Product: cPanel & WHM and WP2 (WordPress Squared)
Name: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
CISA KEV added: 2026-04-30
Known ransomware use: Known
CWEs: CWE-306
Description: WebPros cPanel & WHM (WebHost Manager)... | ## Why this CVE matters right now
- `CVE-2026-41940` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-30).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `cP... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-41940",
"vendor": "WebPros",
"product": "cPanel & WHM and WP2 (WordPress Squared)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-29635
Vendor: D-Link
Product: DIR-823X
Name: D-Link DIR-823X Command Injection Vulnerability
CISA KEV added: 2026-04-24
Known ransomware use: Unknown
CWEs: CWE-77
Description: D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on rem... | ## Why this CVE matters right now
- `CVE-2025-29635` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-24).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-29635",
"vendor": "D-Link",
"product": "DIR-823X"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-7399
Vendor: Samsung
Product: MagicINFO 9 Server
Name: Samsung MagicINFO 9 Server Path Traversal Vulnerability
CISA KEV added: 2026-04-24
Known ransomware use: Unknown
CWEs: CWE-22, CWE-434
Description: Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to writ... | ## Why this CVE matters right now
- `CVE-2024-7399` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-24).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `M... | [
"PathTraversal",
"LFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-7399",
"vendor": "Samsung",
"product": "MagicINFO 9 Server"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-57728
Vendor: SimpleHelp
Product: SimpleHelp
Name: SimpleHelp Path Traversal Vulnerability
CISA KEV added: 2026-04-24
Known ransomware use: Known
CWEs: CWE-22
Description: SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by u... | ## Why this CVE matters right now
- `CVE-2024-57728` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-24).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Si... | [
"PathTraversal",
"LFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-57728",
"vendor": "SimpleHelp ",
"product": "SimpleHelp"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-57726
Vendor: SimpleHelp
Product: SimpleHelp
Name: SimpleHelp Missing Authorization Vulnerability
CISA KEV added: 2026-04-24
Known ransomware use: Known
CWEs: CWE-862
Description: SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with... | ## Why this CVE matters right now
- `CVE-2024-57726` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-24).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Si... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-57726",
"vendor": "SimpleHelp ",
"product": "SimpleHelp"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-39987
Vendor: Marimo
Product: Marimo
Name: Marimo Remote Code Execution Vulnerability
CISA KEV added: 2026-04-23
Known ransomware use: Unknown
CWEs: CWE-306
Description: Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execu... | ## Why this CVE matters right now
- `CVE-2026-39987` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-23).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-39987",
"vendor": "Marimo",
"product": "Marimo"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-33825
Vendor: Microsoft
Product: Defender
Name: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
CISA KEV added: 2026-04-22
Known ransomware use: Unknown
CWEs: CWE-1220
Description: Microsoft Defender contains an insufficient granularity of access control vulnerability that coul... | ## Why this CVE matters right now
- `CVE-2026-33825` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-22).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-33825",
"vendor": "Microsoft",
"product": "Defender"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20122
Vendor: Cisco
Product: Catalyst SD-WAN Manger
Name: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-648
Description: Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerabilit... | ## Why this CVE matters right now
- `CVE-2026-20122` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20122",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manger"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20133
Vendor: Cisco
Product: Catalyst SD-WAN Manager
Name: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-200
Description: Cisco Catalyst SD-WAN Manager contains an exposure of sensit... | ## Why this CVE matters right now
- `CVE-2026-20133` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20133",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-2749
Vendor: Kentico
Product: Kentico Xperience
Name: Kentico Xperience Path Traversal Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-22, CWE-434
Description: Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync S... | ## Why this CVE matters right now
- `CVE-2025-2749` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `K... | [
"PathTraversal",
"LFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-2749",
"vendor": "Kentico",
"product": "Kentico Xperience"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2023-27351
Vendor: PaperCut
Product: NG/MF
Name: PaperCut NG/MF Improper Authentication Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Known
CWEs: CWE-287
Description: PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on ... | ## Why this CVE matters right now
- `CVE-2023-27351` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `NG... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2023-27351",
"vendor": "PaperCut",
"product": "NG/MF"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-48700
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-79
Description: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vuln... | ## Why this CVE matters right now
- `CVE-2025-48700` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"XSS"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-48700",
"vendor": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20128
Vendor: Cisco
Product: Catalyst SD-WAN Manager
Name: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-257
Description: Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable f... | ## Why this CVE matters right now
- `CVE-2026-20128` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20128",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-32975
Vendor: Quest
Product: KACE Systems Management Appliance (SMA)
Name: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Unknown
CWEs: CWE-287
Description: Quest KACE Systems Management Appliance (SMA) contains an impro... | ## Why this CVE matters right now
- `CVE-2025-32975` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-32975",
"vendor": "Quest",
"product": "KACE Systems Management Appliance (SMA)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-27199
Vendor: JetBrains
Product: TeamCity
Name: JetBrains TeamCity Relative Path Traversal Vulnerability
CISA KEV added: 2026-04-20
Known ransomware use: Known
CWEs: CWE-23
Description: JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be perform... | ## Why this CVE matters right now
- `CVE-2024-27199` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Te... | [
"PathTraversal",
"LFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-27199",
"vendor": "JetBrains",
"product": "TeamCity"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2009-0238
Vendor: Microsoft
Product: Office
Name: Microsoft Office Remote Code Execution
CISA KEV added: 2026-04-14
Known ransomware use: Unknown
CWEs: CWE-94
Description: Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected ... | ## Why this CVE matters right now
- `CVE-2009-0238` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-14).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `O... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2009-0238",
"vendor": "Microsoft",
"product": "Office"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-3502
Vendor: TrueConf
Product: Client
Name: TrueConf Client Download of Code Without Integrity Check Vulnerability
CISA KEV added: 2026-04-02
Known ransomware use: Unknown
CWEs: CWE-494
Description: TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able ... | ## Why this CVE matters right now
- `CVE-2026-3502` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-02).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `C... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-3502",
"vendor": "TrueConf",
"product": "Client"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-5281
Vendor: Google
Product: Dawn
Name: Google Dawn Use-After-Free Vulnerability
CISA KEV added: 2026-04-01
Known ransomware use: Unknown
CWEs: CWE-416
Description: Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute a... | ## Why this CVE matters right now
- `CVE-2026-5281` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-04-01).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `D... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-5281",
"vendor": "Google",
"product": "Dawn"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-3055
Vendor: Citrix
Product: NetScaler
Name: Citrix NetScaler Out-of-Bounds Read Vulnerability
CISA KEV added: 2026-03-30
Known ransomware use: Unknown
CWEs: CWE-125
Description: Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contai... | ## Why this CVE matters right now
- `CVE-2026-3055` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-30).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `N... | [
"SAML"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-3055",
"vendor": "Citrix",
"product": "NetScaler"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-33634
Vendor: Aquasecurity
Product: Trivy
Name: Aquasecurity Trivy Embedded Malicious Code Vulnerability
CISA KEV added: 2026-03-26
Known ransomware use: Unknown
CWEs: CWE-506
Description: Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to e... | ## Why this CVE matters right now
- `CVE-2026-33634` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-26).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-33634",
"vendor": "Aquasecurity",
"product": "Trivy"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-43510
Vendor: Apple
Product: Multiple Products
Name: Apple Multiple Products Improper Locking Vulnerability
CISA KEV added: 2026-03-20
Known ransomware use: Unknown
CWEs: CWE-667
Description: Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a... | ## Why this CVE matters right now
- `CVE-2025-43510` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-43510",
"vendor": "Apple",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20131
Vendor: Cisco
Product: Secure Firewall Management Center (FMC)
Name: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
CISA KEV added: 2026-03-19
Known ransomware use: Known
CWEs: CWE-502
... | ## Why this CVE matters right now
- `CVE-2026-20131` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-19).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Se... | [
"Deserialization"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20131",
"vendor": "Cisco",
"product": "Secure Firewall Management Center (FMC)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-47813
Vendor: Wing FTP Server
Product: Wing FTP Server
Name: Wing FTP Server Information Disclosure Vulnerability
CISA KEV added: 2026-03-16
Known ransomware use: Unknown
CWEs: CWE-209
Description: Wing FTP Server contains a generation of error message containing sensitive information vulnerability when u... | ## Why this CVE matters right now
- `CVE-2025-47813` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-16).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-47813",
"vendor": "Wing FTP Server",
"product": "Wing FTP Server"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-3910
Vendor: Google
Product: Chromium V8
Name: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
CISA KEV added: 2026-03-13
Known ransomware use: Unknown
CWEs: CWE-119
Description: Google Chromium V8 contains an improper restriction of operations with... | ## Why this CVE matters right now
- `CVE-2026-3910` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-13).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `C... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-3910",
"vendor": "Google",
"product": "Chromium V8"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-1603
Vendor: Ivanti
Product: Endpoint Manager (EPM)
Name: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
CISA KEV added: 2026-03-09
Known ransomware use: Unknown
CWEs: CWE-288
Description: Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channe... | ## Why this CVE matters right now
- `CVE-2026-1603` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-09).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: ` ... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-1603",
"vendor": "Ivanti",
"product": " Endpoint Manager (EPM)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2017-7921
Vendor: Hikvision
Product: Multiple Products
Name: Hikvision Multiple Products Improper Authentication Vulnerability
CISA KEV added: 2026-03-05
Known ransomware use: Unknown
CWEs: CWE-287
Description: Multiple Hikvision products contain an improper authentication vulnerability that could allow a mali... | ## Why this CVE matters right now
- `CVE-2017-7921` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `M... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2017-7921",
"vendor": "Hikvision",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2021-22681
Vendor: Rockwell
Product: Multiple Products
Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
CISA KEV added: 2026-03-05
Known ransomware use: Unknown
CWEs: CWE-522
Description: Multiple Rockwell products contain an insufficient protected credentials vulnerability. St... | ## Why this CVE matters right now
- `CVE-2021-22681` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2021-22681",
"vendor": "Rockwell",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2021-30952
Vendor: Apple
Product: Multiple Products
Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
CISA KEV added: 2026-03-05
Known ransomware use: Unknown
CWEs: CWE-190
Description: Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerabilit... | ## Why this CVE matters right now
- `CVE-2021-30952` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-03-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2021-30952",
"vendor": "Apple",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-25108
Vendor: Soliton Systems K.K
Product: FileZen
Name: Soliton Systems K.K FileZen OS Command Injection Vulnerability
CISA KEV added: 2026-02-24
Known ransomware use: Unknown
CWEs: CWE-78
Description: Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the ... | ## Why this CVE matters right now
- `CVE-2026-25108` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-24).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-25108",
"vendor": "Soliton Systems K.K",
"product": "FileZen"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-49113
Vendor: Roundcube
Product: Webmail
Name: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
CISA KEV added: 2026-02-20
Known ransomware use: Unknown
CWEs: CWE-502
Description: RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code executio... | ## Why this CVE matters right now
- `CVE-2025-49113` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE",
"Deserialization"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-49113",
"vendor": "Roundcube",
"product": "Webmail"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-22769
Vendor: Dell
Product: RecoverPoint for Virtual Machines (RP4VMs)
Name: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
CISA KEV added: 2026-02-18
Known ransomware use: Unknown
CWEs: CWE-798
Description: Dell RecoverPoint for Virtual Machines (RP4VMs) conta... | ## Why this CVE matters right now
- `CVE-2026-22769` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-18).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-22769",
"vendor": "Dell",
"product": "RecoverPoint for Virtual Machines (RP4VMs)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-7694
Vendor: TeamT5
Product: ThreatSonar Anti-Ransomware
Name: TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability
CISA KEV added: 2026-02-17
Known ransomware use: Unknown
CWEs: CWE-434
Description: TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted up... | ## Why this CVE matters right now
- `CVE-2024-7694` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-17).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `T... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-7694",
"vendor": "TeamT5",
"product": "ThreatSonar Anti-Ransomware"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20700
Vendor: Apple
Product: Multiple Products
Name: Apple Multiple Buffer Overflow Vulnerability
CISA KEV added: 2026-02-12
Known ransomware use: Unknown
CWEs: CWE-119
Description: Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory bu... | ## Why this CVE matters right now
- `CVE-2026-20700` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-12).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20700",
"vendor": "Apple",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-43468
Vendor: Microsoft
Product: Configuration Manager
Name: Microsoft Configuration Manager SQL Injection Vulnerability
CISA KEV added: 2026-02-12
Known ransomware use: Unknown
CWEs: CWE-89
Description: Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker c... | ## Why this CVE matters right now
- `CVE-2024-43468` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-12).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"SQLi"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-43468",
"vendor": "Microsoft",
"product": "Configuration Manager"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-15556
Vendor: Notepad++
Product: Notepad++
Name: Notepad++ Download of Code Without Integrity Check Vulnerability
CISA KEV added: 2026-02-12
Known ransomware use: Unknown
CWEs: CWE-494
Description: Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability t... | ## Why this CVE matters right now
- `CVE-2025-15556` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-12).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-15556",
"vendor": "Notepad++",
"product": "Notepad++"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-21513
Vendor: Microsoft
Product: Windows
Name: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
CISA KEV added: 2026-02-10
Known ransomware use: Unknown
CWEs: CWE-693
Description: Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unau... | ## Why this CVE matters right now
- `CVE-2026-21513` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-10).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-21513",
"vendor": "Microsoft",
"product": "Windows"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-21525
Vendor: Microsoft
Product: Windows
Name: Microsoft Windows NULL Pointer Dereference Vulnerability
CISA KEV added: 2026-02-10
Known ransomware use: Unknown
CWEs: CWE-476
Description: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorize... | ## Why this CVE matters right now
- `CVE-2026-21525` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-10).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-21525",
"vendor": "Microsoft",
"product": "Windows"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-11953
Vendor: React Native Community
Product: CLI
Name: React Native Community CLI OS Command Injection Vulnerability
CISA KEV added: 2026-02-05
Known ransomware use: Unknown
CWEs: CWE-78
Description: React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticat... | ## Why this CVE matters right now
- `CVE-2025-11953` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-11953",
"vendor": "React Native Community",
"product": "CLI"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-24423
Vendor: SmarterTools
Product: SmarterMail
Name: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
CISA KEV added: 2026-02-05
Known ransomware use: Known
CWEs: CWE-306
Description: SmarterTools SmarterMail contains a missing authentication for critical function vulne... | ## Why this CVE matters right now
- `CVE-2026-24423` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Sm... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-24423",
"vendor": "SmarterTools",
"product": "SmarterMail"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2021-39935
Vendor: GitLab
Product: Community and Enterprise Editions
Name: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
CISA KEV added: 2026-02-03
Known ransomware use: Unknown
CWEs: CWE-918
Description: GitLab Community and Enterprise Editions contain a server-side... | ## Why this CVE matters right now
- `CVE-2021-39935` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-03).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"SSRF"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2021-39935",
"vendor": "GitLab",
"product": "Community and Enterprise Editions"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-64328
Vendor: Sangoma
Product: FreePBX
Name: Sangoma FreePBX OS Command Injection Vulnerability
CISA KEV added: 2026-02-03
Known ransomware use: Unknown
CWEs: CWE-78
Description: Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication com... | ## Why this CVE matters right now
- `CVE-2025-64328` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-02-03).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-64328",
"vendor": "Sangoma",
"product": "FreePBX "
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-24858
Vendor: Fortinet
Product: Multiple Products
Name: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
CISA KEV added: 2026-01-27
Known ransomware use: Unknown
CWEs: CWE-288
Description: Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contai... | ## Why this CVE matters right now
- `CVE-2026-24858` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-27).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-24858",
"vendor": "Fortinet",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2018-14634
Vendor: Linux
Product: Kernel
Name: Linux Kernel Integer Overflow Vulnerability
CISA KEV added: 2026-01-26
Known ransomware use: Unknown
CWEs: CWE-190
Description: Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user... | ## Why this CVE matters right now
- `CVE-2018-14634` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-26).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2018-14634",
"vendor": "Linux",
"product": "Kernel"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-23760
Vendor: SmarterTools
Product: SmarterMail
Name: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
CISA KEV added: 2026-01-26
Known ransomware use: Known
CWEs: CWE-288
Description: SmarterTools SmarterMail contains an authentication bypass using an altern... | ## Why this CVE matters right now
- `CVE-2026-23760` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-26).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Sm... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-23760",
"vendor": "SmarterTools",
"product": "SmarterMail"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-21509
Vendor: Microsoft
Product: Office
Name: Microsoft Office Security Feature Bypass Vulnerability
CISA KEV added: 2026-01-26
Known ransomware use: Unknown
CWEs: CWE-807
Description: Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security dec... | ## Why this CVE matters right now
- `CVE-2026-21509` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-26).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-21509",
"vendor": "Microsoft",
"product": "Office"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2024-37079
Vendor: Broadcom
Product: VMware vCenter Server
Name: Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
CISA KEV added: 2026-01-23
Known ransomware use: Unknown
CWEs: CWE-787
Description: Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementatio... | ## Why this CVE matters right now
- `CVE-2024-37079` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-23).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2024-37079",
"vendor": "Broadcom",
"product": "VMware vCenter Server"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-68645
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
CISA KEV added: 2026-01-22
Known ransomware use: Unknown
CWEs: CWE-98
Description: Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inc... | ## Why this CVE matters right now
- `CVE-2025-68645` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-22).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-68645",
"vendor": "Synacor",
"product": " Zimbra Collaboration Suite (ZCS)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-54313
Vendor: Prettier
Product: eslint-config-prettier
Name: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
CISA KEV added: 2026-01-22
Known ransomware use: Unknown
CWEs: CWE-506
Description: Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installi... | ## Why this CVE matters right now
- `CVE-2025-54313` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-22).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-54313",
"vendor": "Prettier",
"product": "eslint-config-prettier"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2026-20045
Vendor: Cisco
Product: Unified Communications Manager
Name: Cisco Unified Communications Products Code Injection Vulnerability
CISA KEV added: 2026-01-21
Known ransomware use: Unknown
CWEs: CWE-94
Description: Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Se... | ## Why this CVE matters right now
- `CVE-2026-20045` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-21).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2026-20045",
"vendor": "Cisco",
"product": "Unified Communications Manager"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-37164
Vendor: Hewlett Packard Enterprise (HPE)
Product: OneView
Name: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
CISA KEV added: 2026-01-07
Known ransomware use: Unknown
CWEs: CWE-94
Description: Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability th... | ## Why this CVE matters right now
- `CVE-2025-37164` is on the CISA Known Exploited Vulnerabilities catalog (added 2026-01-07).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-37164",
"vendor": "Hewlett Packard Enterprise (HPE)",
"product": "OneView"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-14733
Vendor: WatchGuard
Product: Firebox
Name: WatchGuard Firebox Out of Bounds Write Vulnerability
CISA KEV added: 2025-12-19
Known ransomware use: Unknown
CWEs: CWE-787
Description: WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerabil... | ## Why this CVE matters right now
- `CVE-2025-14733` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-19).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-14733",
"vendor": "WatchGuard",
"product": "Firebox"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-59374
Vendor: ASUS
Product: Live Update
Name: ASUS Live Update Embedded Malicious Code Vulnerability
CISA KEV added: 2025-12-17
Known ransomware use: Unknown
CWEs: CWE-506
Description: ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modification... | ## Why this CVE matters right now
- `CVE-2025-59374` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-17).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-59374",
"vendor": "ASUS",
"product": "Live Update"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-14611
Vendor: Gladinet
Product: CentreStack and Triofox
Name: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
CISA KEV added: 2025-12-15
Known ransomware use: Unknown
CWEs: CWE-798
Description: Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability fo... | ## Why this CVE matters right now
- `CVE-2025-14611` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-15).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"PathTraversal",
"LFI"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-14611",
"vendor": "Gladinet",
"product": "CentreStack and Triofox"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-43529
Vendor: Apple
Product: Multiple Products
Name: Apple Multiple Products Use-After-Free WebKit Vulnerability
CISA KEV added: 2025-12-15
Known ransomware use: Unknown
CWEs: CWE-416
Description: Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processi... | ## Why this CVE matters right now
- `CVE-2025-43529` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-15).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-43529",
"vendor": "Apple",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-58360
Vendor: OSGeo
Product: GeoServer
Name: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
CISA KEV added: 2025-12-11
Known ransomware use: Unknown
CWEs: CWE-611
Description: OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerabili... | ## Why this CVE matters right now
- `CVE-2025-58360` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-11).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"XXE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-58360",
"vendor": "OSGeo",
"product": "GeoServer"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-55182
Vendor: Meta
Product: React Server Components
Name: Meta React Server Components Remote Code Execution Vulnerability
CISA KEV added: 2025-12-05
Known ransomware use: Known
CWEs: (none listed)
Description: Meta React Server Components contains a remote code execution vulnerability that could allow un... | ## Why this CVE matters right now
- `CVE-2025-55182` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-12-05).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Known**.
## Attack surface to fingerprint
- Product: `Re... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-55182",
"vendor": "Meta",
"product": "React Server Components"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2021-26829
Vendor: OpenPLC
Product: ScadaBR
Name: OpenPLC ScadaBR Cross-site Scripting Vulnerability
CISA KEV added: 2025-11-28
Known ransomware use: Unknown
CWEs: CWE-79
Description: OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
Required mitigation (defender side): Ap... | ## Why this CVE matters right now
- `CVE-2021-26829` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-11-28).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"XSS"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2021-26829",
"vendor": "OpenPLC",
"product": "ScadaBR"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-21042
Vendor: Samsung
Product: Mobile Devices
Name: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
CISA KEV added: 2025-11-10
Known ransomware use: Unknown
CWEs: CWE-787
Description: Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability... | ## Why this CVE matters right now
- `CVE-2025-21042` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-11-10).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-21042",
"vendor": "Samsung",
"product": "Mobile Devices"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-48703
Vendor: CWP
Product: Control Web Panel
Name: CWP Control Web Panel OS Command Injection Vulnerability
CISA KEV added: 2025-11-04
Known ransomware use: Unknown
CWEs: CWE-78
Description: CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauth... | ## Why this CVE matters right now
- `CVE-2025-48703` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-11-04).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-48703",
"vendor": "CWP",
"product": "Control Web Panel"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-24893
Vendor: XWiki
Product: Platform
Name: XWiki Platform Eval Injection Vulnerability
CISA KEV added: 2025-10-30
Known ransomware use: Unknown
CWEs: CWE-95
Description: XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a... | ## Why this CVE matters right now
- `CVE-2025-24893` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-30).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-24893",
"vendor": "XWiki",
"product": "Platform"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2022-48503
Vendor: Apple
Product: Multiple Products
Name: Apple Multiple Products Unspecified Vulnerability
CISA KEV added: 2025-10-20
Known ransomware use: Unknown
CWEs: (none listed)
Description: Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when proc... | ## Why this CVE matters right now
- `CVE-2022-48503` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-20).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2022-48503",
"vendor": "Apple",
"product": "Multiple Products"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-47827
Vendor: IGEL
Product: IGEL OS
Name: IGEL OS Use of a Key Past its Expiration Date Vulnerability
CISA KEV added: 2025-10-14
Known ransomware use: Unknown
CWEs: CWE-324
Description: IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flas... | ## Why this CVE matters right now
- `CVE-2025-47827` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-14).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-47827",
"vendor": "IGEL",
"product": "IGEL OS"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-24990
Vendor: Microsoft
Product: Windows
Name: Microsoft Windows Untrusted Pointer Dereference Vulnerability
CISA KEV added: 2025-10-14
Known ransomware use: Unknown
CWEs: CWE-822
Description: Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for priv... | ## Why this CVE matters right now
- `CVE-2025-24990` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-14).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-24990",
"vendor": "Microsoft",
"product": "Windows"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2016-7836
Vendor: SKYSEA
Product: Client View
Name: SKYSEA Client View Improper Authentication Vulnerability
CISA KEV added: 2025-10-14
Known ransomware use: Unknown
CWEs: CWE-287
Description: SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in p... | ## Why this CVE matters right now
- `CVE-2016-7836` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-14).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `C... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2016-7836",
"vendor": "SKYSEA",
"product": "Client View"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2025-27915
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
CISA KEV added: 2025-10-07
Known ransomware use: Unknown
CWEs: CWE-79
Description: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vuln... | ## Why this CVE matters right now
- `CVE-2025-27915` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-07).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"XSS"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2025-27915",
"vendor": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2021-22555
Vendor: Linux
Product: Kernel
Name: Linux Kernel Heap Out-of-Bounds Write Vulnerability
CISA KEV added: 2025-10-06
Known ransomware use: Unknown
CWEs: CWE-787
Description: Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (v... | ## Why this CVE matters right now
- `CVE-2021-22555` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-06).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `... | [
"KEV"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2021-22555",
"vendor": "Linux",
"product": "Kernel"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2013-3918
Vendor: Microsoft
Product: Windows
Name: Microsoft Windows Out-of-Bounds Write Vulnerability
CISA KEV added: 2025-10-06
Known ransomware use: Unknown
CWEs: (none listed)
Description: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX contr... | ## Why this CVE matters right now
- `CVE-2013-3918` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-06).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `W... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2013-3918",
"vendor": "Microsoft",
"product": "Windows"
} |
You are advising an authorized bug bounty hunter on a CVE that CISA has confirmed is being actively exploited. Explain why it should be top-of-list, how to fingerprint the affected product on the program's surface, what evidence to collect, and how to frame impact in the report. [Scope: authorized bug bounty / pentest ... | CVE: CVE-2011-3402
Vendor: Microsoft
Product: Windows
Name: Microsoft Windows Remote Code Execution Vulnerability
CISA KEV added: 2025-10-06
Known ransomware use: Unknown
CWEs: (none listed)
Description: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in ... | ## Why this CVE matters right now
- `CVE-2011-3402` is on the CISA Known Exploited Vulnerabilities catalog (added 2025-10-06).
- That means real-world adversaries are using it; a triager will treat reachable instances as **critical**.
- Ransomware-use signal: **Unknown**.
## Attack surface to fingerprint
- Product: `W... | [
"RCE"
] | {
"source": "cisa_kev",
"cve_id": "CVE-2011-3402",
"vendor": "Microsoft",
"product": "Windows"
} |
End of preview. Expand in Data Studio
HunterLLM SFT v1
Instruction + preference dataset for training a bug-bounty / offensive-security assistant that thinks like a red-teamer, prioritizes attacker primitives and reachable impact, and writes triager-friendly reports — strictly scoped to authorized engagements (bug bounty programs, contracted pentests, isolated labs).
Files
| File | Rows | Schema |
|---|---|---|
sft_train.jsonl |
~33.1k | {instruction, input, output, tags, meta} |
dpo_pairs.jsonl |
~33.1k | {prompt, chosen, rejected} |
Sources (raw)
| Source family | Provider | Records (raw) | License |
|---|---|---|---|
| GitHub repos (26 curated) | Various | ~20.6k files | MIT / Apache-2.0 / CC-BY-SA-4.0 / BSD / CC-BY-4.0 / Public Domain |
| NVD API 2.0 | NIST | ~3.5k CVEs (90 day window) | Public domain |
| CISA KEV catalog | DHS CISA | ~1.6k actively-exploited CVEs | Public domain |
| MITRE ATT&CK (Enterprise) | MITRE | ~697 techniques | Apache-2.0 |
| Curated writeup URLs | trafilatura-extracted | ~28 long-form research posts | Per-site (text excerpts only, provenance in meta) |
GitHub repos used
OWASP/CheatSheetSeries, OWASP/wstg, OWASP/ASVS, OWASP/owasp-mastg, OWASP/API-Security, OWASP/Top10, swisskyrepo/PayloadsAllTheThings, swisskyrepo/InternalAllTheThings, danielmiessler/SecLists (filtered), projectdiscovery/nuclei-templates, rapid7/metasploit-framework (docs only), reddelexc/hackerone-reports (indexes only), nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters, jhaddix/tbhm, Hari-prasaanth/Web-App-Pentest-Checklist, harshinsecurity/web-pentesting-checklist, dwisiswant0/awesome-oneliner-bugbounty, infoslack/awesome-web-hacking, EdOverflow/bugbounty-cheatsheet, ngalongc/bug-bounty-reference, Ignitetechnologies/Mindmap, 0xInfection/Awesome-WAF, bugcrowd/vulnerability-rating-taxonomy, devanshbatham/Awesome-Bugbounty-Writeups, kh4sh3i/Bug-Bounty-Writeups, qazbnm456/awesome-web-security.
Writeup URL hosts
portswigger.net (Research blog), googleprojectzero.blogspot.com, blog.doyensec.com, research.nccgroup.com, bishopfox.com, posts.specterops.io, blog.assetnote.io, labs.detectify.com, blog.detectify.com, projectdiscovery.io, github.blog, snyk.io, www.acunetix.com, owasp.org.
Instruction synthesis
Per-source specialized templates produce diverse training signals:
- GitHub generic:
hunt_plan,code_review,report_draft. - GitHub specialized: Metasploit module → exploitation + proof-of-impact +
adjacent surfaces. HackerOne report-index row → infer primitive + hunt strategy
- report skeleton. Nuclei template → matcher analysis + weaponization + adjacent templates. OWASP doc → focused triple-template.
- NVD CVE: three templates per CVE —
triage(offensive root cause),hunt(fingerprint + evidence),report(HackerOne-style skeleton). - CISA KEV: "actively-exploited" priority framing with vendor/product fingerprinting and severity uplift narrative.
- MITRE ATT&CK: TTP → offensive operator framing (kill-chain phase, evidence, defender telemetry to expect).
- URL writeups: offensive distillation of research posts (attacker playbook + impact stack + replay strategy).
Every instruction carries the AUTHORIZATION_NOTE so the model learns to keep
work scoped to authorized targets.
Curation pipeline
- Quality scoring penalizes config/build files, short or low-prose inputs, pure YAML/key-value blobs.
- MinHash LSH deduplication at threshold 0.85 (datasketch).
- Tag inference on bug-class keywords — XSS, SQLi, RCE, SSRF, XXE, Deserialization, OAuth, GraphQL, PathTraversal/LFI/RFI, CSRF, CSP, CORS, IDOR, etc.
DPO pair synthesis
For each curated SFT row we keep the original output as chosen and
synthesize a deliberately weaker / over-cautious rejected response, training
the model to prefer concrete attacker-primitive reasoning over generic
defensive boilerplate.
Intended use
- Fine-tuning small/mid open LLMs (Llama-3-8B-Instruct, Mistral-7B-Instruct, DeepSeek-Coder, etc.) for bug-bounty mentoring, report drafting, and attacker-primitive analysis on authorized targets.
- Not intended for unauthorized testing, weaponization against third parties, or evasion of program rules.
Limitations & known biases
- HackerOne report titles are public metadata only; the dataset does not contain disclosed report bodies.
- Public writeup extraction is best-effort (some sites JS-render or block scrapers); failed URLs are silently skipped.
- Quality filter is heuristic; a small fraction of low-signal rows remain.
- Built on a single NVD lookback window — extend with
hunter-llm collect-nvd --years Nfor longer coverage. - CISA KEV uses templated short descriptions; MinHash dedup drops ~70% of entries as near-duplicates by design (the 482 surviving rows still represent the breadth of vendor/product/CVE primitives).
Reproducibility
Generated by HunterLLM:
hunter-llm bootstrap-data --skip-trickest --full \
--urls data/urls/writeups.txt
# Or piecewise:
hunter-llm collect-github --skip-trickest
hunter-llm collect-nvd --years 3
hunter-llm collect-cisa-kev
hunter-llm collect-mitre-attack
hunter-llm collect-urls data/urls/writeups.txt
hunter-llm build-dataset
hunter-llm export-dpo
License
CC-BY-SA-4.0, matching the most restrictive permissive source license in the
mix (OWASP). Underlying sources retain their respective licenses; provenance
is preserved in meta.
- Downloads last month
- 27