SecureBlock
Log in
Threat feed

What attackers are exploiting right now

SecureBlock runs a honeypot for each of these vulnerabilities across our five locations. The counts below are real exploitation attempts we observed, updated hourly.

Sorted by attempts · click a row for the full advisory
SeverityCVEVulnerabilityPublishedAttemptsΔ 24h
10.0CVE-2024-3400Palo Alto PAN-OS GlobalProtect command injectionKEVPalo Alto Networks2024-04-122,632+8%10.0CVE-2021-44228Apache Log4j JNDI remote code execution (Log4Shell)KEVApache Software Foundation2021-12-101,975+24%9.4CVE-2023-4966Citrix NetScaler ADC session token disclosure (Citrix Bleed)KEVCitrix2023-10-101,919-2%9.1CVE-2024-21887Ivanti Connect Secure command injectionKEVIvanti2024-01-121,382+11%10.0CVE-2023-22515Atlassian Confluence broken access controlKEVAtlassian2023-10-041,038+14%9.8CVE-2019-0708Windows RDP remote code execution (BlueKeep)KEVMicrosoft2019-05-14764+6%9.8CVE-2023-34362MOVEit Transfer SQL injectionKEVProgress Software2023-06-02608+24%9.8CVE-2017-9841PHPUnit eval-stdin remote code executionKEVSebastian Bergmann / PHPUnit2017-06-27415-2%

Counts are unique source IP and payload combinations hitting SecureBlock honeypots, deduplicated per hour. The colored edge marks CVSS severity. CVSS, EPSS and KEV status are on each advisory page.

Find out if any of these apply to your attack surface.