Briefing Zero-days CVEs IOCs NewsActors Vendors Licenses Help

⌘+KWorkspace→

Real-time security intelligence — KEV, CVEs, exploits, threat actors and IOCs unified into one live view.

Sources Status API docs RSS feeds Licenses Help Security disclosure

Built by Kiril Urbonas

ZeroDayAttack — AppSec intelligence aggregator

19 results

For "0-day" across CVEs, vendor advisories, threat actors, IOCs, security research, and news.

All19 Vulnerabilities1 Threat actors0 Vendor advisories0 Research16 News2 IOCs0

Instant answer

Active zero-day exploitation

Most-recent KEV catalog additions and news items mentioning in-the-wild exploitation.

Featured CVEs

CVE-2026-110447—Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS c1 d ago
CVE-2026-114625Critical· 9.9Arista VeloCloud Orchestrator SQL Injection Vulnerability2 d ago
CVE-2026-96652Medium· 4.3Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Vulnerabilities

CVE-2025-64293High· 7.66 d ago
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.

Research

unit42
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in
CVE-2026-88771 · CVE-2026-88772
24 d ago

3 d ago

CVE-2026-106931High· 7.8SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.3 d ago

CVE-2026-110936Medium· 6.7A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to pla3 d ago

CVE-2026-96654Medium· 6.5Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.3 d ago

Recent coverage

thehackernewsArista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks2 d ago
bleepingcomputerArista patches new VeloCloud Orchestrator zero-day exploited in attacks2 d ago
thehackernews⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More5 d ago
thehackernewsChina-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers9 d ago
bleepingcomputerBeyondTrust patches zero-day exploited in attacks since August9 d ago
bleepingcomputerCisco patches new Secure Email Gateway zero-day exploited in attacks10 d ago

All actively-exploited CVEs

volexity

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome ( CVE-2026-85046 , CVE-2026-87491 ) and Microsoft Windows ( CVE-2026-85880 ) by two different Chinese

CVE-2026-85046 · CVE-2026-87491 · CVE-2026-85880

2026-09-21

volexity

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

On September 1, 2026, Volexity's Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails

CVE-2026-85046 · CVE-2026-87491 · CVE-2026-85880

2026-09-09

volexity

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day

CVE-2026-15409 · CVE-2026-15410

2026-07-17

arxiv

AI Code Sandboxes: A Comparative Security Study. Part 1 of 2 -- Engine-Level Properties (Attack Surface, Leakage, Stackability, CVE History, Patch Cadence, Fuzzing)

arXiv:2606.08433v1 Announce Type: new Abstract: This paper reads six engine-level measurements together -- 1.1 host attack surface, 1.2 information leakage, 1.3 defense-in-depth stackability, 1.4 public CVE history, 1.5 patch cadence, and 1

2026-06-09

wiz

Gogs 0-Day Exploited in the Wild

Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-8110

CVE-2025-8110

2025-12-10

snyk

Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem

CVE-2023-4863 vulnerability identified in the WebP library libwebp extends to more than just browsers - Learn how to find and fix this critical vulnerability with Snyk

CVE-2023-4863

2023-09-28

huntress

Everything We Know About CVE-2023-23397 | Huntress

Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.

CVE-2023-23397

2023-03-17

wiz

CVE-2022-27518 exploited in the wild by APT5: everything you need to know

Detect and mitigate CVE-2022-27518, a Citrix ADC and Gateway unauthenticated RCE 0-day exploited in the wild by a nation state actor. Organizations should patch urgently.

CVE-2022-27518

2022-12-13

huntress

New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress

The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.

2022-09-29

wiz

A 90-Day Action Plan to Turn Resolutions into Results with Wiz

Whether you're new to Wiz or early in your cloud security journey, start the year strong by turning cloud security resolutions into real impact in your first 90 days with Wiz.

2026-01-14

arxiv

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

arXiv:2609.13719v2 Announce Type: replace Abstract: Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its

3 d ago

talos

There's only so much code: the rise in vulnerability numbers

Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume

CVE-2021-44228

4 d ago

mend

Frontier Model Is the Wrong Meter for Continuous Security

The economics of continuous security at frontier-model prices, and why the math points back to independence. The frontier models are astonishing at finding vulnerabilities. That is not in dispute, and it is not what this piece is about. The

2026-06-18

tenable

The June 2026 AI Executive Order: What federal agencies need to know and how Tenable can help

On June 2, 2026, the White House signed an Executive Order directing federal agencies to harden their systems with AI-enabled cyber defenses and to stand up a new AI cybersecurity clearinghouse - most of it on a 30-day clock. Here's what t

2026-06-04

githubblog

GitHub expands application security coverage with AI-powered detections

AI is accelerating software development and expanding the range of languages and frameworks used in modern repositories. Security teams are increasingly responsible for protecting code written across many ecosystems, not just the core enter

2026-03-23

News

thehackernews
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
12 d ago
thehackernews
⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else's entry point. Scroll through the full Monday Cybersecurity
2026-06-15