VORANT. Threat Intelligence Research Create a free account

Latest threat intelligence reports

The free public tier, updated through the day: government and CERT reporting, rated on evidence. Where a report has indicators or detections, a free account opens them in the app. The paid plans add the security research and news reporting the free tier leaves out.
PublishedReportVorant rating
Macfinger ClickFix delivers macOS DownTheDRAIN stealer routine
TightVNC, UltraVNC Viewers Hit by Heap Overflow routine
Penlink's Webloc ad-surveillance tool spreads globally routine
ImageMagick file read/write flaws dubbed ImageTragick2 routine
RCE flaw found in npm library promzard routine
Unpatched RCE flaw hits ComfyUI-Easy-Use extension routine
Ivanti Endpoint Manager fixes critical SQL injection routine
Node.js patches multiple HTTP/2, TLS vulnerabilities routine
Citrix patches 27 flaws across NetScaler, Gateway routine
Operation Endgame dismantles Gootloader, CastleRAT, StealC routine
Fortinet patches 18 FortiAuthenticator vulnerabilities routine
NCSC Flags Eight Critical FortiOS Flaws routine
Siemens Industrial Edge hit by Node2Shell flaw high
Siemens Energy Products Hit by Critical PHP RCE Flaws severe
Siemens Desigo, Gridscale hit by Node.js flaw severe
Siemens RUGGEDCOM APE1808 Hit by PAN-OS Flaws severe
Fortinet patches dozens of FortiManager/FortiAnalyzer flaws routine
Scanners exploit GPUStack auth bypass flaw high
Fortinet patches 24 FortiMail vulnerabilities routine
Fortinet patches FortiClient, FortiClientEMS flaws routine
SAP patches 44 flaws across NetWeaver products routine
Apache HTTP Server mod_http2 RCE flaw patched elevated
ANSSI issues second REACTIV situation update routine
Palo Alto Networks Patches Dozens of Flaws routine
CERT-FR Patch Tuesday bulletin: Microsoft products routine
GitLab RCE flaw patched, CVE-2026-105437 routine
CERT-FR Flags Multiple Chrome Vulnerabilities routine
CERT-FR Patches Multiple Xen Hypervisor Flaws routine
CERT-FR Flags Check Point RCE Flaws severe
CERT-FR Patch Tuesday Advisory for Windows routine
Mozilla Patches Dozens of Firefox Flaws routine
Citrix Secure Access Client privilege escalation flaws routine
Apache HTTP Server patches multiple CVEs routine
CERT-FR flags Laravel security bypass flaws Not tied to an actor or CVE routine
CERT-FR Bulletin: Multiple Intel CPU Vulnerabilities Not tied to an actor or CVE routine
Google Patches Dozens of Pixel Vulnerabilities routine
HPE Aruba Private 5G Core flaws patched elevated
CERT-FR flags multiple Azure vulnerabilities routine
CERT-FR Warns of Kaspersky DoS Flaw high
CERT-FR Flags 21 Flaws in .NET routine
NetApp ONTAP Tools for vSphere Patched routine
Mitel MiVoice MX-ONE faces RCE flaws Not tied to an actor or CVE routine
CERT-FR Flags Multiple Axis Product Vulnerabilities routine
CERT-FR Flags Citrix XenServer Vulnerabilities routine
CERT-FR Advisory: Multiple Microsoft Edge Flaws elevated
Ivanti patches multiple vulnerabilities across products routine
Active Exploitation Hits Microsoft Office RCE Flaw high
CERT-FR flags multiple MongoDB Server flaws Not tied to an actor or CVE routine
CERT-FR warns of Traefik vulnerabilities Not tied to an actor or CVE routine
Fortinet patches dozens of FortiOS, FortiManager flaws routine
Fortinet patches FortiSandbox XSS flaw routine
Adobe Photoshop patches multiple code execution flaws routine
Adobe Experience Manager patches critical code flaws routine
GitLab Patches Heap Overflow in Merge Handling routine
Siemens patches multiple SIMATIC, COMOS flaws severe
N-able N-central patches multiple high-severity flaws routine
Fortinet patches dozens of FortiOS, FortiManager flaws routine
Europe faces suspected Russian hybrid warfare surge Not tied to an actor or CVE routine
Microsoft Patch Tuesday: Actively Exploited Zero-Day high
Mozilla Patches Dozens of Firefox Flaws routine
NCSC-NL flags 9 Exchange Server flaws routine
Microsoft patches 55 SQL Server flaws routine
Adobe Patches Dozens of Code-Execution Flaws routine
NCSC-NL flags critical Azure OpenAI auth bypass routine
Microsoft Patches 180+ Office Flaws Including SharePoint RCE routine
NCSC-NL Flags Mass Microsoft Dev Tools Patch routine
NCSC-NL Details Critical Microsoft Windows Patches routine
Microsoft November 2027 Patch Tuesday: 1,260 CVEs severe
Apple patches multiple iOS, macOS vulnerabilities severe
SAP Patches Dozens of Flaws Across NetWeaver Stack routine
Actively exploited Outlook spoofing flaw patched high
Chrome zero-day CVE-2026-125350 under active exploitation high
Apple patches nine flaws across OS lineup routine
CISA KEV adds six actively exploited flaws severe
SonicWall SonicOS flaws enable auth bypass high
Siemens SIMATIC Flaws Allow Remote Code Execution severe
Schneider EcoStruxure Power Build Rapsody flaw patched routine
Synology DSM patches 26 vulnerabilities routine
CERT-FR Details Multiple SAP Patch Tuesday Flaws elevated
Confluence Data Center RCE Patched routine
CERT-FR Advisory: Multiple OpenSSL Vulnerabilities routine
CERT-FR Flags Multiple Apple Product Vulnerabilities high
Shibboleth OIDC OP plugin patched Not tied to an actor or CVE routine
CERT-FR Warns of Firefox iOS Flaws routine
CERT-FR Warns of Roundcube Webmail Flaws Not tied to an actor or CVE routine
Chrome zero-day CVE-2026-125350 exploited high
Scanners probe for SAP NetWeaver webshells elevated
FrodoBots EarthRover Mini+ had fleet-wide root RCE routine
PrestaShop debug-mode PHP injection flaw patched routine
CISA KEV adds GPUStack, FreeSwitch, OpenSSH, Aspera flaws severe
WidzialniCMS flaws allow unauthenticated RCE routine
SonicWall patches actively exploited SSL-VPN SAML bypass high
CERT-FR Flags Synology Plex and Chat Flaws high
Xen Patches Three Privilege Escalation Flaws routine
CERT-FR Flags Moodle Security Bypass Flaw routine
IRGC units Shahid Shoostari, Kaveh hit France routine
CERT-FR flags mass VMware Tanzu CVE bundle high
SonicWall SonicOS flaw actively exploited high
Scanners exploit new SSH 'Sshole' flaw severe
Chrome Patches Over 150 Vulnerabilities elevated

Published is the source's own date; "added" marks a report whose source gave none, dated by the day Vorant added it. Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app a report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) wherever it has them, and live profiles of the actors and CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs