NetSight
IP …

Security Dashboard

A live picture of new vulnerabilities, flaws exploited in the wild and malicious packages, next to the hostile infrastructure we track.

Sort: Min CVSS:

Get notifications

Subscribe to new vulnerabilities and early warnings from the last seven days. Pick what matters to your stack and copy the address into any feed reader.

Format:
Open feed

Early warnings are advisories that are published before or without a CVE number, for example malicious packages, advisories with a CVE still pending and reports that are not reviewed yet. Confidence says how well an entry is checked: high, medium or low.

About this dashboard

The dashboard keeps its own index of security advisories and refreshes it every 30 minutes. It merges the national vulnerability database, package advisories, malware reports and the catalog of vulnerabilities that are exploited in the wild into one record per issue. Reports about the same flaw are combined, so nothing is listed twice.

Next to the vulnerabilities it shows the hostile infrastructure we track (attack sources, botnet control servers, anonymizer exits and our own honeypot). Open any entry for the full record: description, severity vector, affected packages and versions, fixed versions, weakness class, exploitation probability and references.

Reading the figures

  • Threat level: a rating computed from three numbers shown next to it: critical advisories in the last 24 hours, vulnerabilities newly confirmed as exploited this week and malware reports this week. It is a quick orientation, not an official warning level.
  • Severity: scores from 9.0 are critical, 7.0 to 8.9 high, 4.0 to 6.9 medium and 0.1 to 3.9 low. Severity describes how bad a flaw is in general. It does not know whether the component is reachable in your environment.
  • Known exploited: exploitation has been observed in real attacks. These are the entries to patch first. Entries with a fix deadline show how many days are left.
  • Early warnings: advisories that appear before or without a CVE number, for example malicious packages, reviewed advisories with a CVE still pending and reports that are not reviewed yet.
  • Priority queue: critical and high advisories of the last 7 days and everything newly exploited, ordered by exploitation status, severity and score.

Questions

Where does the data come from?
From public vulnerability databases, package advisories and the catalog of exploited vulnerabilities. NetSight collects them into its own index every 30 minutes and merges duplicates.
How do I check whether I am affected?
Search for your product or package name, open the record and compare your installed version with the affected and fixed versions. A product name alone does not mean your version is affected.
What does known exploited mean?
Exploitation of this vulnerability has been observed in real attacks. Such entries carry a date they were confirmed and, where one exists, a deadline for applying the fix.
What is an early warning?
An advisory that is published before or without a CVE number, such as a malicious package or a reviewed advisory whose CVE is still pending. They give you a head start, but the details can change.
Is a high severity always more urgent than a low one?
No. Severity measures technical impact in general. Exposure of the affected system, observed exploitation and the exploitation probability matter as much.
Can I follow new advisories automatically?
Yes. Use the notification builder further down to create an RSS, Atom or JSON feed filtered by severity, technology, ecosystem or exploitation status.
Subdomain Finder
Enumerate subdomains across 7 passive sources.
Blocklist Check
Check an IPv4 address against fifteen threat feeds, grouped by category.
Reverse IP Lookup
List all domains hosted on an IPv4 address from passive DNS, with links to DNS and WHOIS.
IP Lookup
Instant geolocation, ISP, ASN, abuse history and reputation for any IPv4 or IPv6 address.