Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1071

T1071Application Layer Protocol

T1071 — Application Layer Protocol is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 13 detection use cases covering it and 423 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
13Use cases
423Articles
5Sub-techniques
1Tactic

Sub-techniques (5)

T1071.004 · DNST1071.002 · File Transfer ProtocolsT1071.003 · Mail ProtocolsT1071.005 · Publish/Subscribe ProtocolsT1071.001 · Web Protocols

Use cases covering this technique (13)

Network connections to article IPs / domains Internal c2 · alerting DSΣP [WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) Internal exploit · alerting DSPDD Windows App Layer Protocol Qakbot NamedPipe ESCU actions · hunting P Windows App Layer Protocol Wermgr Connect To NamedPipe ESCU actions · hunting P Windows Application Layer Protocol RMS Radmin Tool Namedpipe ESCU actions · alerting P Cisco Secure Firewall - High Priority Intrusion Classification ESCU actions · alerting P Cisco Secure Firewall - High Volume of Intrusion Events Per Host ESCU actions · hunting P [LLM] Outbound beacon/callback from internal host to VeloCloud Orchestrator attacker IPs (CVE-2026-16812) Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound reverse-shell egress from GitLab Ruby/Puma worker as git — Oj RCE connect-back Bespoke c2 · hunting DSPCS [LLM] redis-server initiates unexpected outbound / lateral connections (post-RCE egress) Bespoke actions · hunting DSPCS [LLM] SprySOCKS (FishMonger/I-SOON) C2 beacon to hardcoded Vultr IPs 207.148.78.36 / 207.148.75.122 Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound C2 to sfrclak.com / 142.11.206.73:8000 (Axios npm RAT beacon) Bespoke c2 · alerting DSΣPDDCS [LLM] CircleCI breach C2 egress to potrax[.]com and 8 hardcoded attacker IPs Bespoke c2 · hunting DSΣPCSCW

Articles citing this technique (423)

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-00
high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access art-02
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments art-19
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser art-22
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass art-26
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-29
crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-33
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw art-55
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-58
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
crit Don’t swing at everything art-106
crit Email threat landscape: Q2 2026 trends and insights art-108
crit Russian Global Webmail Espionage art-111
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-112
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-114
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-115
high The upgrade trap: when upgrading is the wrong answer to a CVE art-119
crit CISA KEV: CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability art-120
crit [GHSA / CRITICAL] CVE-2026-20896: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user vi art-124
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-132
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-140
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-152
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-158
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-159
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
high AsyncAPI npm packages backdoored via GitHub Actions art-181
high How Aikido Intel detects malware and vulnerabilities first art-189
crit What is a dependency firewall? art-192
crit jscrambler npm package publishes malicious preinstall binary art-195
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-197
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit Winning 54% of the time art-214
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-215
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-216
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit UAT-7810 continues building ORB networks using new malware art-229
crit CISA KEV: CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability art-230
crit CISA KEV: CVE-2026-55255 — Langflow Authorization Bypass Through User-Controlled Key Vulnerability art-231
crit CISA KEV: CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability art-233
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
high Cyber readiness for SMBs: Getting the basics right art-249
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-253
high Catan and Mouse art-261
crit Secure Registry now tells you which machine pulled a compromised package art-271
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-272
high Maven Support Comes to GitHub Checks and OSS Package Search art-273
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-277
high npm now freezes high-impact accounts after risky account changes art-288
med Packagist is now protected by Aikido Intel and other updates to the PHP registry art-292
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Everybody's shipping code they can't read art-295
crit CISA KEV: CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability art-297
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
high When a vendor's breach becomes yours: lessons from the Klue incident art-307
crit CISA KEV: CVE-2025-67038 — Lantronix EDS5000 Code Injection Vulnerability art-308
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-314
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316
high The full Snyk AI Security Platform, free for open source maintainers art-319
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high Multiple JetBrains IDE plugins caught stealing AI keys art-326
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-328
crit CISA KEV: CVE-2026-48907 — Widget Factory Joomla Content Editor Improper Access Control Vulnerability art-329
high EvilTokens: A phishing attack that doesn’t steal your password art-331
crit CISA KEV: CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability art-338
high npm v12 delivers one of the biggest security improvements in years art-339
crit OceanLotus: From external espionage to domestic targeting art-342
high Code is being written everywhere, and the device is the only constant art-344
crit Compromised Rust crate onering performs code exfiltration art-346
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-358
high Why EDR and proxy won’t save you from supply chain malware art-369
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-371
high What MDM can't protect on developer machines (and what to do about it) art-386
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-388
crit CISA KEV: CVE-2026-45321 — TanStack Unspecified Vulnerability art-394
crit CISA KEV: CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability art-395
high Why developer machines are now the number one target for supply chain attacks art-396
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-397
crit Laravel Lang Supply Chain Advisory art-399
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-401
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-402
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
crit Webworm: New burrowing techniques art-413
crit CISA KEV: CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability art-418
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-426
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-457
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining art-476
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit GopherWhisper: A burrow full of malware art-484
crit CISA KEV: CVE-2026-39987 — Marimo Remote Code Execution Vulnerability art-487
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-517
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-521
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high You Patched LiteLLM, But Do You Know Your AI Blast Radius? art-536
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-550
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-553
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-557
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
high Glassworm Strikes Popular React Native Phone Number Packages art-587
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-594
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
high How “Clinejection” Turned an AI Bot into a Supply Chain Attack art-628
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-664
crit DynoWiper update: Technical analysis and attribution art-684
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-753
high SHA1-Hulud, npm supply chain incident art-766
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773
crit CISA KEV: CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-790
crit The who, where, and how of APT attacks in Q2 2025–Q3 2025 art-792
crit CISA KEV: CVE-2025-11371 — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability art-799
crit CISA KEV: CVE-2025-24893 — XWiki Platform Eval Injection Vulnerability art-801
crit CISA KEV: CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability art-804
crit CISA KEV: CVE-2025-59287 — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability art-805
crit CISA KEV: CVE-2025-61932 — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability art-808
crit CISA KEV: CVE-2025-61884 — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability art-813
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
crit CISA KEV: CVE-2025-27915 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability art-825
crit CISA KEV: CVE-2010-3962 — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability art-827
crit CISA KEV: CVE-2010-3765 — Mozilla Multiple Products Remote Code Execution Vulnerability art-831
crit CISA KEV: CVE-2025-61882 — Oracle E-Business Suite Unspecified Vulnerability art-832
crit CISA KEV: CVE-2025-21043 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-836
crit CISA KEV: CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability art-841
high Malicious MCP Server on npm postmark-mcp Harvests Emails art-844
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
crit CISA KEV: CVE-2025-5086 — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability art-853
high npm Supply Chain Attack via Open Source maintainer compromise art-855
crit CISA KEV: CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability art-859
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-879
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
crit CISA KEV: CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability art-899
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-902
crit CISA KEV: CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability art-904
crit CISA KEV: CVE-2023-33538 — TP-Link Multiple Routers Command Injection Vulnerability art-925
crit CISA KEV: CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability art-931
crit CISA KEV: CVE-2025-24016 — Wazuh Server Deserialization of Untrusted Data Vulnerability art-932
crit CISA KEV: CVE-2024-42009 — RoundCube Webmail Cross-Site Scripting Vulnerability art-933
crit CISA KEV: CVE-2025-32433 — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability art-934
crit CISA KEV: CVE-2021-32030 — ASUS Routers Improper Authentication Vulnerability art-944
crit CISA KEV: CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability art-946
crit CISA KEV: CVE-2023-39780 — ASUS RT-AX55 Routers OS Command Injection Vulnerability art-948
crit CISA KEV: CVE-2024-27443 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-958
crit CISA KEV: CVE-2025-27920 — Srimax Output Messenger Directory Traversal Vulnerability art-959
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-960
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-961
crit CISA KEV: CVE-2025-4427 — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability art-962
crit CISA KEV: CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability art-963
crit CISA KEV: CVE-2024-12987 — DrayTek Vigor Routers OS Command Injection Vulnerability art-964
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-965
crit CISA KEV: CVE-2024-11120 — GeoVision Devices OS Command Injection Vulnerability art-974
crit CISA KEV: CVE-2024-6047 — GeoVision Devices OS Command Injection Vulnerability art-975
crit CISA KEV: CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability art-984
crit CISA KEV: CVE-2025-3928 — Commvault Web Server Unspecified Vulnerability art-988
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-990
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-994
crit CISA KEV: CVE-2025-29824 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-998
crit CISA KEV: CVE-2025-30406 — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability art-999
crit CISA KEV: CVE-2025-31161 — CrushFTP Authentication Bypass Vulnerability art-1000
crit CISA KEV: CVE-2025-24813 — Apache Tomcat Path Equivalence Vulnerability art-1004
crit CISA KEV: CVE-2025-2783 — Google Chromium Mojo Sandbox Escape Vulnerability art-1007
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1019
crit CISA KEV: CVE-2025-21590 — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability art-1023
crit CISA KEV: CVE-2025-26633 — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability art-1034
crit CISA KEV: CVE-2024-57968 — Advantive VeraCore Unrestricted File Upload Vulnerability art-1038
crit CISA KEV: CVE-2025-25181 — Advantive VeraCore SQL Injection Vulnerability art-1039
crit CISA KEV: CVE-2023-20118 — Cisco Small Business RV Series Routers Command Injection Vulnerability art-1051
crit Do not pass GO - Malicious Package Alert art-1067
crit CISA KEV: CVE-2024-41710 — Mitel SIP Phones Argument Injection Vulnerability art-1069
crit CISA KEV: CVE-2025-0994 — Trimble Cityworks Deserialization Vulnerability art-1074
crit CISA KEV: CVE-2024-50603 — Aviatrix Controllers OS Command Injection Vulnerability art-1095
crit CISA KEV: CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1102
crit CISA KEV: CVE-2023-48365 — Qlik Sense HTTP Tunneling Vulnerability art-1103
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1114
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1121
crit CISA KEV: CVE-2024-20767 — Adobe ColdFusion Improper Access Control Vulnerability art-1123
crit CISA KEV: CVE-2024-50623 — Cleo Multiple Products Unrestricted File Upload Vulnerability art-1124
high Ultralytics AI Pwn Request Supply Chain Attack art-1125
crit CISA KEV: CVE-2024-9474 — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability art-1148
crit CISA KEV: CVE-2024-0012 — Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability art-1149
crit CISA KEV: CVE-2024-43451 — Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability art-1160
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1161
crit CISA KEV: CVE-2024-8956 — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability art-1166
crit CISA KEV: CVE-2024-37383 — RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability art-1172
crit CISA KEV: CVE-2024-47575 — Fortinet FortiManager Missing Authentication Vulnerability art-1175
crit CISA KEV: CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability art-1178
crit CISA KEV: CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability art-1186
crit CISA KEV: CVE-2024-9380 — Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability art-1191
crit CISA KEV: CVE-2024-23113 — Fortinet Multiple Products Format String Vulnerability art-1193
crit CISA KEV: CVE-2024-45519 — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability art-1199
crit CISA KEV: CVE-2023-25280 — D-Link DIR-820 Router OS Command Injection Vulnerability art-1206
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1213
crit CISA KEV: CVE-2014-0497 — Adobe Flash Player Integer Underflow Vulnerablity art-1223
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1227
crit CISA KEV: CVE-2024-40766 — SonicWall SonicOS Improper Access Control Vulnerability art-1232
crit CISA KEV: CVE-2024-7262 — Kingsoft WPS Office Path Traversal Vulnerability art-1238
crit CISA KEV: CVE-2024-7971 — Google Chromium V8 Type Confusion Vulnerability art-1247
crit CISA KEV: CVE-2018-0824 — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability art-1271
crit CISA KEV: CVE-2024-28995 — SolarWinds Serv-U Path Traversal Vulnerability art-1285
crit CISA KEV: CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability art-1286
crit CISA KEV: CVE-2024-36401 — OSGeo GeoServer GeoTools Eval Injection Vulnerability art-1287
crit CISA KEV: CVE-2024-23692 — Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability art-1291
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1296
crit CISA KEV: CVE-2024-4577 — PHP-CGI OS Command Injection Vulnerability art-1312
crit CISA KEV: CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability art-1319
crit CISA KEV: CVE-2024-24919 — Check Point Quantum Security Gateways Information Disclosure Vulnerability art-1322
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1324
crit CISA KEV: CVE-2024-4947 — Google Chromium V8 Type Confusion Vulnerability art-1331
crit CISA KEV: CVE-2024-20359 — Cisco ASA and FTD Privilege Escalation Vulnerability art-1352
crit CISA KEV: CVE-2024-20353 — Cisco ASA and FTD Denial of Service Vulnerability art-1353
crit CISA KEV: CVE-2024-3400 — Palo Alto Networks PAN-OS Command Injection Vulnerability art-1362
crit CISA KEV: CVE-2024-3273 — D-Link Multiple NAS Devices Command Injection Vulnerability art-1364
crit CISA KEV: CVE-2023-48788 — Fortinet FortiClient EMS SQL Injection Vulnerability art-1375
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1396
crit CISA KEV: CVE-2024-21351 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1406
crit CISA KEV: CVE-2023-22527 — Atlassian Confluence Data Center and Server Template Injection Vulnerability art-1416
crit CISA KEV: CVE-2018-15133 — Laravel Deserialization of Untrusted Data Vulnerability art-1428
crit CISA KEV: CVE-2023-46805 — Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability art-1431
crit CISA KEV: CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1437
crit CISA KEV: CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1438
crit CISA KEV: CVE-2023-7101 — Spreadsheet::ParseExcel Remote Code Execution Vulnerability art-1442
crit CISA KEV: CVE-2023-49897 — FXC AE1021, AE1021PE OS Command Injection Vulnerability art-1447
crit CISA KEV: CVE-2023-47565 — QNAP VioStor NVR OS Command Injection Vulnerability art-1448
crit CISA KEV: CVE-2023-41266 — Qlik Sense Path Traversal Vulnerability art-1459
crit CISA KEV: CVE-2023-41265 — Qlik Sense HTTP Tunneling Vulnerability art-1460
crit CISA KEV: CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability art-1487
crit CISA KEV: CVE-2023-47246 — SysAid Server Path Traversal Vulnerability art-1499
med Real-time threat protection with Snyk and SentinelOne art-1506
crit CISA KEV: CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability art-1511
crit CISA KEV: CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability art-1516
crit CISA KEV: CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1521
crit CISA KEV: CVE-2023-20273 — Cisco IOS XE Web UI Command Injection Vulnerability art-1529
crit CISA KEV: CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation Vulnerability art-1533
crit CISA KEV: CVE-2023-22515 — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability art-1546
crit CISA KEV: CVE-2023-40044 — Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability art-1547
crit CISA KEV: CVE-2023-42793 — JetBrains TeamCity Authentication Bypass Vulnerability art-1552
crit CISA KEV: CVE-2023-41991 — Apple Multiple Products Improper Certificate Validation Vulnerability art-1562
crit CISA KEV: CVE-2023-41992 — Apple Multiple Products Kernel Privilege Escalation Vulnerability art-1563
crit CISA KEV: CVE-2023-33246 — Apache RocketMQ Command Execution Vulnerability art-1589
crit CISA KEV: CVE-2023-27532 — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability art-1603
high .NET developers alert: Moq NuGET package exfiltrates user emails from git art-1610
crit CISA KEV: CVE-2023-37580 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1627
crit CISA KEV: CVE-2023-3519 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability art-1637
crit CISA KEV: CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability art-1641
crit CISA KEV: CVE-2022-29303 — SolarView Compact Command Injection Vulnerability art-1643
crit CISA KEV: CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability art-1648
crit CISA KEV: CVE-2019-17621 — D-Link DIR-859 Router Command Execution Vulnerability art-1655
crit CISA KEV: CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability art-1656
crit CISA KEV: CVE-2023-32434 — Apple Multiple Products Integer Overflow Vulnerability art-1667
crit CISA KEV: CVE-2023-2868 — Barracuda Networks ESG Appliance Improper Input Validation Vulnerability art-1707
crit CISA KEV: CVE-2023-25717 — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability art-1727
crit CISA KEV: CVE-2023-27350 — PaperCut MF/NG Improper Access Control Vulnerability art-1755
crit CISA KEV: CVE-2023-28252 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-1770
crit CISA KEV: CVE-2021-27876 — Veritas Backup Exec Agent File Access Vulnerability art-1775
crit CISA KEV: CVE-2021-27877 — Veritas Backup Exec Agent Improper Authentication Vulnerability art-1776
crit CISA KEV: CVE-2021-27878 — Veritas Backup Exec Agent Command Execution Vulnerability art-1777
crit CISA KEV: CVE-2022-27926 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1789
crit CISA KEV: CVE-2022-22706 — Arm Mali GPU Kernel Driver Unspecified Vulnerability art-1800
crit The rising trend of malicious packages in open source ecosystems art-1804
crit CISA KEV: CVE-2023-23397 — Microsoft Office Outlook Privilege Escalation Vulnerability art-1811
crit CISA KEV: CVE-2022-41328 — Fortinet FortiOS Path Traversal Vulnerability art-1813
crit CISA KEV: CVE-2022-36537 — ZK Framework AuUploader Unspecified Vulnerability art-1829
crit CISA KEV: CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability art-1861
crit CISA KEV: CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1869
high Supply chain security incident at CircleCI: Rotate your secrets art-1872
crit CISA KEV: CVE-2022-42475 — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability art-1889
med Fetch the Flag CTF 2022 writeup: Disposable Message art-1921
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1924
high Fetch the Flag CTF 2022 writeup: Moongoose art-1925
high Fetch the Flag CTF 2022 writeup: File Explorer art-1927
crit CISA KEV: CVE-2022-41128 — Microsoft Windows Scripting Languages Remote Code Execution Vulnerability art-1933
high Avoiding SMTP Injection: A Whitebox primer art-2006
crit CISA KEV: CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability art-2045
crit CISA KEV: CVE-2022-2294 — WebRTC Heap Buffer Overflow Vulnerability art-2048
crit How open source C++ code can introduce security risks art-2059
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
crit CISA KEV: CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability art-2100
crit CISA KEV: CVE-2022-29499 — Mitel MiVoice Connect Data Validation Vulnerability art-2109
crit CISA KEV: CVE-2012-0754 — Adobe Flash Player Memory Corruption Vulnerability art-2148
crit CISA KEV: CVE-2011-2462 — Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability art-2150
crit CISA KEV: CVE-2022-26134 — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability art-2165
crit CISA KEV: CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability art-2176
crit CISA KEV: CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability art-2198
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2203
crit CISA KEV: CVE-2016-4657 — Apple iOS Webkit Memory Corruption Vulnerability art-2220
crit CISA KEV: CVE-2016-3298 — Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability art-2223
crit CISA KEV: CVE-2019-13720 — Google Chrome WebAudio Use-After-Free Vulnerability art-2236
crit CISA KEV: CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability art-2237
crit Targeted npm dependency confusion attack caught red-handed art-2273
crit CISA KEV: CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability art-2298
crit CISA KEV: CVE-2022-22954 — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability art-2307
crit CISA KEV: CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability art-2310
crit CISA KEV: CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability art-2327
crit CISA KEV: CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability art-2337
crit Spring4Shell: What we know about the Java RCE vulnerability art-2345
crit CISA KEV: CVE-2018-10562 — Dasan GPON Routers Command Injection Vulnerability art-2351
crit CISA KEV: CVE-2022-0543 — Debian-specific Redis Server Lua Sandbox Escape Vulnerability art-2356
crit CISA KEV: CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability art-2368
crit CISA KEV: CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability art-2369
crit CISA KEV: CVE-2021-22941 — Citrix ShareFile Improper Access Control Vulnerability art-2391
crit CISA KEV: CVE-2020-9054 — Zyxel Multiple NAS Devices OS Command Injection Vulnerability art-2393
crit CISA KEV: CVE-2018-8373 — Microsoft Scripting Engine Memory Corruption Vulnerability art-2412
high Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine art-2459
crit CISA KEV: CVE-2019-1132 — Microsoft Win32k Privilege Escalation Vulnerability art-2467
crit CISA KEV: CVE-2019-11581 — Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability art-2489
med Adding Container and IaC security to the Snyk plugin for Jetbrains art-2496
crit CISA KEV: CVE-2015-3043 — Adobe Flash Player Memory Corruption Vulnerability art-2560
crit CISA KEV: CVE-2013-3897 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2570
crit CISA KEV: CVE-2013-1347 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2573
crit CISA KEV: CVE-2011-0611 — Adobe Flash Player Remote Code Execution Vulnerability art-2584
crit CISA KEV: CVE-2022-24682 — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability art-2599
crit CISA KEV: CVE-2017-8570 — Microsoft Office Remote Code Execution Vulnerability art-2600
crit Magento security requires additional patch to fix sanitization vulnerability art-2604
crit CVE-2022-24086 Vulnerability alert for websites using Magento Ecommerce art-2610
crit CISA KEV: CVE-2022-24086 — Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability art-2616
crit CISA KEV: CVE-2022-0609 — Google Chromium Animation Use-After-Free Vulnerability art-2617
crit CISA KEV: CVE-2017-9841 — PHPUnit Command Injection Vulnerability art-2622
crit CISA KEV: CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability art-2635
crit CISA KEV: CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability art-2636
crit CISA KEV: CVE-2015-2051 — D-Link DIR-645 Router Remote Code Execution Vulnerability art-2641
crit Stranger Danger: Live hack of how a Log4Shell exploit works art-2665
crit CISA KEV: CVE-2018-8453 — Microsoft Win32k Privilege Escalation Vulnerability art-2669
crit CISA KEV: CVE-2021-35247 — SolarWinds Serv-U Improper Input Validation Vulnerability art-2670
med New years resolution: Don’t show my security tokens when hacking my demo application on stage art-2690
crit CISA KEV: CVE-2021-36260 — Hikvision Improper Input Validation art-2695
crit CISA KEV: CVE-2019-2725 — Oracle WebLogic Server, Injection art-2699
crit CISA KEV: CVE-2019-9670 — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference art-2700
crit CISA KEV: CVE-2019-10149 — Exim Mail Transfer Agent (MTA) Improper Input Validation art-2704
crit CISA KEV: CVE-2021-35394 — Realtek Jungle SDK Remote Code Execution Vulnerability art-2739
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2750
crit CISA KEV: CVE-2021-27104 — Accellion FTA OS Command Injection Vulnerability art-2780
crit CISA KEV: CVE-2021-27102 — Accellion FTA OS Command Injection Vulnerability art-2781
crit CISA KEV: CVE-2021-27101 — Accellion FTA SQL Injection Vulnerability art-2782
crit CISA KEV: CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability art-2783
crit CISA KEV: CVE-2018-4878 — Adobe Flash Player Use-After-Free Vulnerability art-2788
crit CISA KEV: CVE-2021-30713 — Apple macOS Unspecified Vulnerability art-2815
crit CISA KEV: CVE-2021-30657 — Apple macOS Unspecified Vulnerability art-2816
crit CISA KEV: CVE-2021-30869 — Apple iOS, iPadOS, and macOS Type Confusion Vulnerability art-2820
crit CISA KEV: CVE-2021-26084 — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability art-2827
crit CISA KEV: CVE-2020-3452 — Cisco ASA and FTD Read-Only Path Traversal Vulnerability art-2831
crit CISA KEV: CVE-2018-0171 — Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability art-2835
crit CISA KEV: CVE-2019-19781 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability art-2846
crit CISA KEV: CVE-2020-25506 — D-Link DNS-320 Device Command Injection Vulnerability art-2849
crit CISA KEV: CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability art-2853
crit CISA KEV: CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability art-2894
crit CISA KEV: CVE-2021-31955 — Microsoft Windows Kernel Information Disclosure Vulnerability art-2902
crit CISA KEV: CVE-2021-31199 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2909
crit CISA KEV: CVE-2021-31956 — Microsoft Windows NTFS Privilege Escalation Vulnerability art-2911
crit CISA KEV: CVE-2021-31201 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2912
crit CISA KEV: CVE-2017-7269 — Microsoft Windows Server Buffer Overflow Vulnerability art-2920
crit CISA KEV: CVE-2021-34473 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2927
crit CISA KEV: CVE-2021-1732 — Microsoft Win32k Privilege Escalation Vulnerability art-2929
crit CISA KEV: CVE-2019-18935 — Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability art-2989
crit CISA KEV: CVE-2020-10148 — SolarWinds Orion Authentication Bypass Vulnerability art-3013
crit CISA KEV: CVE-2021-35211 — SolarWinds Serv-U Remote Code Execution Vulnerability art-3014
crit CISA KEV: CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability art-3020
crit CISA KEV: CVE-2017-9248 — Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability art-3024
crit CISA KEV: CVE-2019-16759 — vBulletin PHP Module Remote Code Execution Vulnerability art-3039
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3048
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3049
crit CISA KEV: CVE-2019-9978 — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability art-3050
crit CISA KEV: CVE-2020-10189 — Zoho ManageEngine Desktop Central File Upload Vulnerability art-3053
med SnykCon 2021 excitement is starting, but the CFP is ending (soon) art-3125