ervik.as
Free · Live · No Signup Required

Real-Time Cyber
Threat Intelligence

The same live CVE, zero-day, and ransomware data enterprise platforms charge for — free, with no account and no paywall. Updated continuously, not on a delay.

CVEs, zero-days, ransomware campaigns, threat actors, OT/ICS advisories, and global attack activity from a single platform.

Subscribe via RSS — get every update the moment it's published
Global Cyber Threat Intelligence
Live intelligence from
0+
CVEs
0+
Threat Actors
0
Active Zero Days
0+
Ransomware Victims
Updated every 15 minutes · running totals tracked since this dashboard went live
Attacks Today
89,270
top 20 DShield sources
New CVEs (7d)
300
12 critical
Active 0-Days (30d)
45
CISA KEV catalog
Ransomware Victims (7d)
257
leak-site disclosures
▸[The Hacker News]CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV▸[Dark Reading]Threat Actor Generates 1M Personalized Fraud Emails in 3 Days▸[Krebs on Security]Microsoft Plugs Nearly 1,000 Security Holes▸[The Hacker News]When the Whole Company Adopts AI: What It Does to Your SOC▸[Dark Reading]CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate▸[Krebs on Security]FBI Probes Service Selling 153M+ Drivers Licenses▸[The Hacker News]OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers▸[Dark Reading]Why AI Is So Good at Scamming Humans▸[Krebs on Security]Two Alleged ‘TeamPCP’ Hackers Arrested in Australia▸[The Hacker News]GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure▸[Dark Reading]AI Governance Can't Wait▸[Krebs on Security]Who’s Tracking You? Use This New Service to Find Out▸[The Hacker News]Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks▸[Dark Reading]Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain▸[Krebs on Security]Microsoft Plugs Nearly 400 Security Holes▸[The Hacker News]Claude Used to Automate Exploitation and Data Theft Across Multiple Victims▸[Dark Reading]Indonesia Hit by Android Banking App-Cloning Campaign▸[Krebs on Security]Canadian Man Pleads Guilty in Snowflake Extortions▸[The Hacker News]Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection▸[Dark Reading]Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data▸[Krebs on Security]Read This Before You Buy That TV Streaming Stick▸[The Hacker News]Your Critical Vulnerabilities Might Not Be Your Biggest Risk▸[Dark Reading]Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit▸[Krebs on Security]LG to Ban Residential Proxies from Smart TV Apps▸[The Hacker News]CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV▸[Dark Reading]Threat Actor Generates 1M Personalized Fraud Emails in 3 Days▸[Krebs on Security]Microsoft Plugs Nearly 1,000 Security Holes▸[The Hacker News]When the Whole Company Adopts AI: What It Does to Your SOC▸[Dark Reading]CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate▸[Krebs on Security]FBI Probes Service Selling 153M+ Drivers Licenses▸[The Hacker News]OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers▸[Dark Reading]Why AI Is So Good at Scamming Humans▸[Krebs on Security]Two Alleged ‘TeamPCP’ Hackers Arrested in Australia▸[The Hacker News]GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure▸[Dark Reading]AI Governance Can't Wait▸[Krebs on Security]Who’s Tracking You? Use This New Service to Find Out▸[The Hacker News]Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks▸[Dark Reading]Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain▸[Krebs on Security]Microsoft Plugs Nearly 400 Security Holes▸[The Hacker News]Claude Used to Automate Exploitation and Data Theft Across Multiple Victims▸[Dark Reading]Indonesia Hit by Android Banking App-Cloning Campaign▸[Krebs on Security]Canadian Man Pleads Guilty in Snowflake Extortions▸[The Hacker News]Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection▸[Dark Reading]Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data▸[Krebs on Security]Read This Before You Buy That TV Streaming Stick▸[The Hacker News]Your Critical Vulnerabilities Might Not Be Your Biggest Risk▸[Dark Reading]Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit▸[Krebs on Security]LG to Ban Residential Proxies from Smart TV Apps

Global Threat Map

Live attack telemetry from the SANS ISC DShield sensor network.

Open full map

Latest CVEs

Newly disclosed vulnerabilities ranked by exploitability.

Full database
CVE-2026-90490medium · 6.3

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Per…

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

· · 9/13/2026
CVE-2026-90651high · 8.1

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. Whe…

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.

· · 9/13/2026
CVE-2026-90648none ·

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fli…

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).

· · 9/13/2026
CVE-2026-90489low · 3.5

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such man…

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

· · 9/13/2026

OT & ICS Security

Industrial control system advisories from CISA's official CSAF repository.

All advisories

Refresh warning: Cache write failed: Error: Too many subrequests by single Worker invocation. To configure this limit, refer to https://developers.cloudflare.com/workers/wrangler/configuration/#limits — showing cached data.

No OT advisories currently cached.

Active Zero-Days

Vulnerabilities being weaponized before patches are available.

All zero-days
CVE-2026-42016actively exploited

JFrog Artifactory Incorrect Authorization Vulnerability

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

JFrog Artifactory
CVE-2026-42018actively exploited

JFrog Artifactory Improper Authentication Vulnerability

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

JFrog Artifactory
CVE-2026-84869actively exploited

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

ConnectWise ScreenConnect

Latest Ransomware Victims

Fresh victim disclosures from active ransomware campaigns.

All victims
Doommageddon2026-09-13

INCOR Group

Status: upcoming | Data size: — | Files: 0 files | Deadline: 2026-09-20T00:00:00Z

Vexy Ransomware2026-09-12

Strad Solutions

Strad Solutions provides cloud hosting, dedicated servers, managed IT, cybersecurity, and disaster recovery services for businesses worldwide.

GB
audit team2026-09-12

AUDIT ENTITY: TE***PB

rhysida2026-09-12

Axdia International

Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More

unsafe2026-09-12

watchops.com

Revenue: $1.3 million

US
AuditTeam2026-09-12

TE***PB

RU

Threat Intel Briefings

Active campaigns from tracked actors over the last 72 hours.

All briefings
threatfox-1916118ClearFakepayload delivery — jtd3m9p0.jurni.storeOpportunistic / untargetedGlobal9/13/2026
threatfox-1916117ClearFakepayload delivery — jurni.storeOpportunistic / untargetedGlobal9/13/2026
threatfox-1916116VShellbotnet cc — 148.66.17.123:60003Opportunistic / untargetedGlobal9/13/2026
threatfox-1916115VShellbotnet cc — 148.66.17.125:60003Opportunistic / untargetedGlobal9/13/2026
threatfox-1916113VShellbotnet cc — 154.91.61.124:8074Opportunistic / untargetedGlobal9/13/2026
Advertisement