⚠️ CVE-2026-45659 (CVSS 8.8, CISA KEV): deserialization flaw in Microsoft SharePoint letting an authenticated attacker with Site Member permissions run code remotely, no user interaction. Actively exploited. Affects SharePoint 2016, 2019 & Sub Edition. Query: technology="Microsoft SharePoint"

⚠️ Squidbleed (CVE-2026-47729, CVSS 6.5): a flaw in Squid's FTP parser that can leak another user's cleartext HTTP request, including credentials, to someone already using the same proxy. Upgrade and verify the patch, or disable FTP. Query: technology="Squid Proxy"

⚠️ DifyTap: 4 Dify vulnerabilities that could expose AI conversations and files across tenants under certain conditions. Two require no auth. Highest-rated is CVE-2026-41948 (CVSS 9.4). Fixed in 1.14.2, except CVE-2026-41948 (next release). Query: product=dify

𝐒𝐭𝐚𝐝𝐢𝐮𝐦 𝐨𝐟 𝐒𝐡𝐚𝐝𝐨𝐰𝐬: 𝐈𝐧𝐬𝐢𝐝𝐞 𝐭𝐡𝐞 𝐈𝐏𝐓𝐕 𝐏𝐢𝐫𝐚𝐜𝐲 𝐖𝐨𝐫𝐥𝐝 The FIFA World Cup is the largest demand event illegal IPTV has ever faced. In the days around kickoff, our research team set out to map the infrastructure behind it. Full field report on the Modat research blog: www.modat.io/post/stadium...

CVE-2026-35273: Unauthenticated RCE in Oracle PeopleSoft PeopleTools (8.61, 8.62) via the Environment Management component. Remotely exploitable with no credentials, can lead to full system compromise. Patch immediately. Query: web.html~"Please click here to PeopleSoft logon page"

⚠️ CISA added CVE-2026-42271 to KEV: Command injection in LiteLLM gateway (1.74.2–1.83.7). MCP preview endpoints spawn attacker commands on the proxy host, gated only by an API key, so any authenticated user gets command execution. Patch to 1.83.7+. Query: product="LiteLLM API" OR product="LiteLLM"

We mapped 973,819 internet-exposed video services. 8,074 were streaming live with no password: thermal sensors on high-voltage equipment, server rooms, feeds in conflict zones. Not just a camera problem. Full research: www.modat.io/post/exposed...

⚠️CVE-2024-21182: Oracle WebLogic Server unauthenticated access via T3/IIOP now actively exploited & added to CISA KEV. Affects 12.2.1.4.0 & 14.1.1.0.0. Patch immediately or block port 7001. Query: web.headers~"WebLogic Server"  magnify.modat.io

⚠️ Drupal announced an upcoming highly critical core security release (PSA-2026-05-18) affecting supported Drupal 10 & 11 branches. Details remain undisclosed, but exploits may emerge within hours of release. Reserve emergency patching time for May 20. Query: technology="Drupal"

⚠️ CVE-2026-42945 (CVSS 9.2): NGINX heap overflow in ngx_http_rewrite_module (≤1.30.0) is actively being exploited in the wild. Crafted HTTP requests via rewrite/if/set PCRE “?” can crash workers and may lead to RCE (ASLR off). Patch now to Nginx 1.31.0 or 1.30.1. Query: technology="Nginx"

⚠️ CVE-2026-44578: SSRF in self-hosted Next.js via the WebSocket upgrade handler allows unauthenticated access to internal services & cloud metadata endpoints using crafted absolute-form HTTP requests. Affected: 13.4.13+ to <15.5.16 / <16.2.5. Query: technology="Next.js"  Platform: magnify.modat.io

️⚠ CVE-2026-7482: Critical heap out-of-bounds read in Ollama via crafted GGUF uploads to /api/create may leak API keys, prompts, credentials & conversation data from process memory. Affected: <0.17.1. Patch now. Query: product="Ollama"  The platform:  magnify.modat.io

⚠️ CVE-2026-23918: Double free in Apache HTTP Server 2.4.66 HTTP/2 may allow unauth RCE via crafted requests, risking full server compromise. Update to 2.4.67 or disable HTTP/2/restrict access. Query: web.headers="Server: Apache/2.4.66"  The platform: magnify.modat.io

⚠️CVE-2025-71284 Synway SMG RCE via en/9-2radius.php(CVSS 9.8). Sed injection via radius_address+POST params enables unauth RCE. No patch. Query: (web.title="IPPBX" or web.html~"synwayjs") OR (web.html~"text ml10 mr20" and (web.title="网关管理软件" or web.title~"Gateway Management")) and tag!="Honeypot"

‼️CVE-2026-41940: cPanel & WHM Authentication Bypass (CVSS 9.8 Critical)  A critical authentication bypass has been discovered in cPanel & WHM. Modat Magnify Query:  (technology="cPanel" or web.html~"/cPanel_magic_revision_" or web.headers~"whostmgrrelogin") and tag!=honeypot

New Modat research: Belastingdienst-themed phishing hitting Dutch taxpayers, mostly aimed at crypto wallets.  Notable shift: attackers ditching backends for direct Telegram bot exfil. Full research: www.modat.io/post/phishin...

Focusing on Iran's "blackout" misses the bigger picture.  New research across 8 countries. Three strategies: mediation, deception, stabilisation. None of them silence.  Read full research: www.modat.io/post/beyond-...

⚠️CVE-2026-34486: Fail-open regression in Tomcat Tribes may lead to unauth RCE. If TCP/4000 is reachable & gadget classes exist on the classpath, unencrypted packets can trigger code execution via bypassed encryption. Affected: 11.0.20, 10.1.53, 9.0.116. Update now! Query: technology="Apache Tomcat"

New research by Modat & Recorded Future reveals how attackers automate defense evasion in a modular cryptomining campaign. Explore the findings: www.modat.io/post/neutral...

⚠️ CVE-2026-33032 (CVSS 9.8) in Nginx UI ≤2.3.5 allows unauthenticated takeover via exposed /mcp_message endpoint (missing auth + fail-open IP whitelist). Attackers can control configs & service. No patch, restrict access now. Query: web.title~"nginx ui"

Citrix fixed CVE-2026-3055 (9.3) & CVE-2026-4368 (7.7) in NetScaler ADC/Gateway. A memory overread may leak data and a race condition can cause session mix-up. Check - (SAML IdP / Gateway / AAA). Query: product="Citrix Gateway" OR product="Citrix ADC" OR web.title~"NetScaler Gateway" tag!=honeypot

⚠️ CISA added CVE-2025-66376 to KEV after active exploitation of Zimbra Collaboration Suite. A stored XSS in the Classic UI allows script injection via HTML emails; opening them can trigger in-session execution and enable mailbox access or session hijacking. Query: product="Zimbra Collaboration"

⚠️️ CISA added CVE-2025-68613 (CVSS 10.0) to KEV. Together with CVE-2026-27577 & CVE-2026-27493, n8n workflow expression flaws allow remote code execution and credential theft, potentially leading to full instance compromise. Patch now.  Query: web.title~"n8n.io - Workflow Automation" tag!=honeypot

CISA added CVE-2026-22719 to KEV after active exploitation of VMware Aria Operations (incl. Cloud Foundation & vSphere Foundation). Patch immediately. Query: web.html~"com.vmware.vsphere.client" OR web.title~"VMware Cloud Director Availability" OR web.title~"VMware Aria Operations"

⚠️ CISA added CVE-2026-20127 to its KEV catalog and issued ED 26-03 after active exploitation of Cisco Catalyst SD-WAN. An auth bypass lets unauthenticated attackers gain admin access and manipulate SD-WAN configs. Patch now. Modat Magnify Query: web.html~"Cisco SD-WAN" OR web.html~"Cisco Catalyst"

CISA added CVE-2025-49113 & CVE-2025-68461 to its KEV catalog after active exploitation of Roundcube Webmail. A 9.9 deserialization flaw enables authenticated RCE, while an SVG animate XSS allows script injection. Patch 1.6.12 / 1.5.12+. Modat Magnify Query: web.title~"Roundcube Webmail"

⚠️ Active exploit. of SolarWinds Web Help Desk. Internet‑exposed WHD hit via unauth RCE. Attackers use Zoho RMM for persistence, Velociraptor for C2/recon/exfil, Cloudflare for access, then disable Defender/firewall. WHD <12.8.7 HF1 is vulnerable. Patch 2026.1+ Magnify Query: web.html.mmh3=1424519104

⚠️CVE-2026-25253: 1-click RCE in OpenClaw. A crafted link leaks gateway tokens via WebSocket, enabling host command execution even on localhost. Fixed v2026.1.29 patch & rotate tokens. Query: web.title~"Clawdbot Control" OR web.title~"OpenClaw Control" OR web.title~"Moltbot Control"  magnify.modat.io

Latest research: Moldbot exposed across 53 countries.  
1,487 hosts leaking data via mDNS, 635 public control panels, and credential artifacts tied to Signal, Telegram & WhatsApp. 
Full research👉 www.modat.io/post/moldbot...

⚠️ CISA added CVE-2026-24858 to its KEV catalog after active exploitation of Fortinet FortiOS via FortiCloud SSO. An auth bypass lets attackers with a FortiCloud account access other tenants’ devices, enabling admin access and config abuse. Patch now. Modat Magnify Query: os="FortiOS" product~"Forti"

⚠️ CISA added CVE‑2024‑37079 to its KEV catalogue after confirmed in‑the‑wild exploitation of VMware vCenter Server. An out‑of‑bounds write in the DCE/RPC protocol allows unauthenticated network‑based RCE via crafted packets. Patch immediately. Modat Magnify Query: product="VMware vCenter"

⚠️ CVE-2026-21962 (CVSS 10.0) impacts Oracle Fusion Middleware, including Oracle HTTP Server and WebLogic Proxy Plug-Ins. Unauthenticated attackers can gain full system control and pivot across environments. Apply Oracle’s January 2026 Critical Patch Update immediately.

⚠️ CISA has added CVE-2025-8110 to its KEV catalog after active exploitation of public-facing Gogs instances. The flaw bypasses a prior RCE fix via improper symlink handling, allowing authenticated attackers to overwrite files and achieve remote code execution. Modat Magnify Query: technology="Gogs"

Cyber Monday Deal 
Get 6 months of Modat Magnify Pro for just €5 total (save €355).  Use code: MODAT2025CYBERMONDAY   
Try the platform. Run advanced queries. Find what others miss. 
 magnify.modat.io 
#CyberMonday #Cybersecurity #OSINT

New Research – Global Impact: Over 1.2 million internet-connected healthcare devices and systems with exposure that endanger patient data.   Findings across 70+ different types of medical devices & systems: MRI, CT, X-rays, hospital management systems, others 
 
👉 Read the full blog:
bit.ly/4fqfKrv

🚨 Cisco fixed CVE-2025-20309 — a root-level backdoor in Unified CM. Affected users must update to 15 SU3 or patch now. Try this query: one_service(product="Cisco UCS Manager") and one_service(port=22 service=ssh) The platform: magnify.modat.io #Modat #CVE202520309 #ModatMagnify #Cisco

🚨 Citrix fixes critical NetScaler bug CVE-2025-5777—patch ASAP. Out-of-bounds flaw similar to CitrixBleed may expose session token. Affects gateway-configured devices. Upgrade + kill active sessions. #citrix #CVE-2025-5777 #modat #modatmagnify Try this query: magnify.modat.io/search?query=p…

🚨 New Feature Finding: Using Device DNA Tag Water Management, we uncovered exposed pump controllers in wastewater systems. A potential gateway for disruption. Platform: magnify.modat.io 
Post: www.linkedin.com/feed/update/...

New in Modat Magnify v1.2.0: • Host-level search • AI Query Assistant • Wildcard DNS search 🧠 Try it free: bit.ly/3ZpvmER #ModatMagnify #CyberSecurity #ThreatIntel

🚦 We found exposed traffic control systems online — and the risk isn’t just red lights. Read how attackers could disrupt urban safety in our latest research using Modat Magnify: tinyurl.com/2jpnhzxe #ModatMagnify #CyberSecurity #SmartCities #FeatureFinding

🚨 CVE-2025-3248 in Langflow is under active exploitation. 
Unauth RCE via exposed endpoint.  
Try with Modat Magnify:  Run → product="Langflow"   
magnify.modat.io  
#Langflow #CVE-2025-3248 #RCE #ModatMagnify #CyberSecurity #CISA #VulnerabilityAlert #LLM #RemoteCodeExecution #Infosec #ThreatIntel

🚨 CVE-2025-2905: XXE vuln in WSO2 API Manager v2.0.0 & older. 
Unauthorisez attackers can read files or DoS your service. 
 Try with Modat Magnify: 
Run this query → web.title="WSO2 API Manager" 
magnify.modat.io  
 Free access until July 1  #CVE-2025-2905 #XXE #ModatMagnify #ThreatIntel #Infosec

🚨 CVE-2025-31324 in SAP NetWeaver allows unauth RCE via file upload. Try with Modat Magnify: Run → product="SAP NetWeaver" magnify.modat.io #ModatMagnify #CVE-2025-31324 #CyberSecurity

🚨 CVE-2025-3616 in Greenshift WP plugin allows RCE via subscriber uploads.  
Update to v11.4.6+ now. 
 Try with Modat Magnify:  
Run → technology="WordPress" web.html~"greenshift" 
magnify.modat.io 
 #ModatMagnify #WordPress #RCE #CVE-2025-3616

🚨CVE-2025-30406 is under active exploit — 7 orgs hit. 
Update CentreStack & Triofox now.  
Try with Modat Magnify: 
Run → web.headers~"Set-Cookie: y-glad-state" 
magnify.modat.io  
#ModatMagnify #CyberSecurity #RCE #CVE202530406 #ModatMagnify #CentreStack #Triofox #VulnerabilityAlert #PatchNow

🚨 New Series Modat Magnify: Feature Findings Kicking series off w/ Case Management ‘Device DNA’ tag. Relevant research for National & Government CSIRTs See our findings & further research: bit.ly/3EcA5SZ 
Tag discoveries w/ #ModatMagnify #research #certs #CSIRT #cybersecurity

🚨 CVE-2025-2805 - Critical WordPress plugin flaw 
ORDER POST plugin (≤2.0.2) lets unauth attackers run arbitrary shortcodes in WP. 
RCE possible.  
Check exposure with Modat Magnify:  technology=Wordpress  
magnify.modat.io  
#WordPress #CVE20252805 #Infosec #ModatMagnify

🚨 CVE-2024-48887 — Critical FortiSwitch flaw (CVSS 9.3)   
Affected: 6.4.0–7.6.0 
Patch ASAP or disable HTTP/HTTPS admin access. 
Find exposed assets with Modat Magnify: 
cert~"FortiSwitch"   
magnify.modat.io   
#CVE-2024-48887 #Fortinet #FortiSwitch #Cybersecurity #Infosec #Vulnerability #PatchNow

🚨 CVE-2025-2704 A critical OpenVPN flaw lets attackers crash servers or run remote code. Over 3.2M services at risk. Check exposure with Modat Magnify, try using this query: protocol=openvpn Start here: magnify.modat.io #CVE20252704 #OpenVPN #Cybersecurity #ModatMagnify #OSINT #Vulnerability

🚨CVE-2025-22457   @Mandiant confirms critical Ivanti Connect Secure RCE vulnerability  📌CVE: bit.ly/4iTpKdD   📊136K+ services found magnify.modat.io   Basic Query bit.ly/3E50TEB  Device DNA bit.ly/4jcSuOV  #ModatMagnify #CVE202522457 #Ivanti #ThreatIntel #UNC5221 #APT #DFIR