ervik.as
Free · Live · No Signup Required

Real-Time Cyber
Threat Intelligence

The same live CVE, zero-day, and ransomware data enterprise platforms charge for — free, with no account and no paywall. Updated continuously, not on a delay.

CVEs, zero-days, ransomware campaigns, threat actors, OT/ICS advisories, and global attack activity from a single platform.

Subscribe via RSS — get every update the moment it's published
Global Cyber Threat Intelligence
Live intelligence from
0+
CVEs
0+
Threat Actors
0
Active Zero Days
0+
Ransomware Victims
Updated every 15 minutes · running totals tracked since this dashboard went live
Attacks Today
89,270
top 20 DShield sources
New CVEs (7d)
300
13 critical
Active 0-Days (30d)
45
CISA KEV catalog
Ransomware Victims (7d)
237
leak-site disclosures
▸[The Hacker News]Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users▸[Dark Reading]Threat Actor Generates 1M Personalized Fraud Emails in 3 Days▸[Krebs on Security]Microsoft Plugs Nearly 1,000 Security Holes▸[The Hacker News]Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data▸[Dark Reading]CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate▸[Krebs on Security]FBI Probes Service Selling 153M+ Drivers Licenses▸[The Hacker News]CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV▸[Dark Reading]Why AI Is So Good at Scamming Humans▸[Krebs on Security]Two Alleged ‘TeamPCP’ Hackers Arrested in Australia▸[The Hacker News]When the Whole Company Adopts AI: What It Does to Your SOC▸[Dark Reading]AI Governance Can't Wait▸[Krebs on Security]Who’s Tracking You? Use This New Service to Find Out▸[The Hacker News]OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers▸[Dark Reading]Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain▸[Krebs on Security]Microsoft Plugs Nearly 400 Security Holes▸[The Hacker News]GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure▸[Dark Reading]Indonesia Hit by Android Banking App-Cloning Campaign▸[Krebs on Security]Canadian Man Pleads Guilty in Snowflake Extortions▸[The Hacker News]Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks▸[Dark Reading]Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data▸[Krebs on Security]Read This Before You Buy That TV Streaming Stick▸[The Hacker News]Claude Used to Automate Exploitation and Data Theft Across Multiple Victims▸[Dark Reading]Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit▸[Krebs on Security]LG to Ban Residential Proxies from Smart TV Apps▸[The Hacker News]Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users▸[Dark Reading]Threat Actor Generates 1M Personalized Fraud Emails in 3 Days▸[Krebs on Security]Microsoft Plugs Nearly 1,000 Security Holes▸[The Hacker News]Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data▸[Dark Reading]CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate▸[Krebs on Security]FBI Probes Service Selling 153M+ Drivers Licenses▸[The Hacker News]CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV▸[Dark Reading]Why AI Is So Good at Scamming Humans▸[Krebs on Security]Two Alleged ‘TeamPCP’ Hackers Arrested in Australia▸[The Hacker News]When the Whole Company Adopts AI: What It Does to Your SOC▸[Dark Reading]AI Governance Can't Wait▸[Krebs on Security]Who’s Tracking You? Use This New Service to Find Out▸[The Hacker News]OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers▸[Dark Reading]Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain▸[Krebs on Security]Microsoft Plugs Nearly 400 Security Holes▸[The Hacker News]GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure▸[Dark Reading]Indonesia Hit by Android Banking App-Cloning Campaign▸[Krebs on Security]Canadian Man Pleads Guilty in Snowflake Extortions▸[The Hacker News]Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks▸[Dark Reading]Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data▸[Krebs on Security]Read This Before You Buy That TV Streaming Stick▸[The Hacker News]Claude Used to Automate Exploitation and Data Theft Across Multiple Victims▸[Dark Reading]Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit▸[Krebs on Security]LG to Ban Residential Proxies from Smart TV Apps

Global Threat Map

Live attack telemetry from the SANS ISC DShield sensor network.

Open full map

Latest CVEs

Newly disclosed vulnerabilities ranked by exploitability.

Full database
CVE-2026-90895none ·

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several au…

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:  - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

· · 9/14/2026
CVE-2026-90894high · 7.8

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSr…

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

· · 9/14/2026
CVE-2026-90893none ·

MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventI…

MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team. Version affected: ≤2.5.45

· · 9/14/2026
CVE-2026-90704medium · 6.6

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Perf…

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

· · 9/14/2026

OT & ICS Security

Industrial control system advisories from CISA's official CSAF repository.

All advisories
ICSA-26-254-01high · 8.8

CISA Malcolm

CISA · 9/11/2026
ICSMA-26-253-02high · 8.1

Orthanc DICOM Server

Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-of-service condition.

Orthanc · 9/10/2026
ICSMA-26-253-01high · 8.3

NextGen Healthcare Mirth Connect

Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition.

NextGen Healthcare · 9/10/2026
ICSA-26-253-01high · 8.4

AVEVA Pipeline Integrity Monitor

Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session.

AVEVA · 9/10/2026

Active Zero-Days

Vulnerabilities being weaponized before patches are available.

All zero-days
CVE-2026-42016actively exploited

JFrog Artifactory Incorrect Authorization Vulnerability

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

JFrog Artifactory
CVE-2026-42018actively exploited

JFrog Artifactory Improper Authentication Vulnerability

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

JFrog Artifactory
CVE-2026-84869actively exploited

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

ConnectWise ScreenConnect

Latest Ransomware Victims

Fresh victim disclosures from active ransomware campaigns.

All victims
qilin2026-09-14

Alicotrans

N/A

BR
Panzer2026-09-13

Cerámicas Kantu

Cerámicas Kantu S.A.C. is a Peruvian company specializing in the manufacturing of decorative tiles and accessories made from ceramic, porcelain, and glass. With over 40 years of experience in the ceramic industry and more than 15 years in producing construction finishes, they offer high-quality products with innovative designs. Their intended clients include distributors and individuals looking to enhance their spaces with unique decorative elements. The company emphasizes customer service and provides assistance through their sales advisors.

qilin2026-09-13

Gilco Scaffolding

N/A

GB
vexy2026-09-13

Strad Solutions

emperador2026-09-13

Navitrans

Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. [Size: 223.2 MB | Sector: Manufacturing, Transportation]

krybit2026-09-13

www.kashkha.com

Kashkha is a multinational modest fashion brand founded three decades ago in Dubai, UAE, specializing in designing, manu...

Threat Intel Briefings

Active campaigns from tracked actors over the last 72 hours.

All briefings
threatfox-1917353Cobalt Strikebotnet cc — 124.222.209.39:50050Opportunistic / untargetedGlobal9/14/2026
threatfox-1917354Cobalt Strikebotnet cc — 111.231.116.164:50050Opportunistic / untargetedGlobal9/14/2026
threatfox-1917355Cobalt Strikebotnet cc — 64.118.153.106:50050Opportunistic / untargetedGlobal9/14/2026
threatfox-1917356Cobalt Strikebotnet cc — 222.255.215.42:50050Opportunistic / untargetedGlobal9/14/2026
threatfox-1917357Cobalt Strikebotnet cc — 155.94.154.152:50050Opportunistic / untargetedGlobal9/14/2026
Advertisement