Hinoki vulnerability directory

Vulnerabilities observed in recent attacks.

Every square is a vulnerability observed by honeypots, placed on its highest-activity day in the last 30 reporting days. Explore the public record and the software it affects.

Read the featured record Search directory

View activity data

Each CVE's highest daily unique-IP count in the last 30 reporting days, plotted by observation date.

Activity data is delayed. The latest report is Sep 28, 2026.

360,592CVEs indexed and searchable

Recently published · Showing 10 of 360,592

CVE-2026-120242Nov 1, 2026Authenticated browser-script injection via cloud URL parameterRuijie Networks, RG-ES210GS-P

Network attack vector

—Unscored CVE-2026-120241Nov 1, 2026Management-plane crash via oversized multipart boundaryRuijie Networks, RG-ES210GS-P

Public exploitNetwork attack vector

—Unscored CVE-2026-120240Nov 1, 2026Root command execution via unescaped group parametersWavlink Technology Ltd., WN553X1-B

Public exploitNetwork attack vector

—Unscored CVE-2026-120239Nov 1, 2026Root command execution via unsanitized file_idWavlink Technology Ltd., WN553X1-B

Public exploitNetwork attack vector

—Unscored CVE-2026-120238Nov 1, 2026Command execution via ovpn_file file_id injectionWavlink Technology Ltd., HALO AIR

Network attack vector

—Unscored CVE-2026-120237Nov 1, 2026Thread hangs via missing interrupt expiryAG-UI Protocol, AG-UI

Public exploitNetwork attack vector

—Unscored CVE-2026-120236Nov 1, 2026Run-state corruption via unvalidated protobuf eventsAG-UI Protocol, AG-UI

Public exploitNetwork attack vector

—Unscored CVE-2026-74760Nov 1, 2026Account substitution via unchecked OAuth callback stateGo standard library, Google::Auth

—Unscored CVE-2026-74759Nov 1, 2026SSRF via unchecked AWS credential-source URLsGo standard library, Google::Auth

—Unscored CVE-2026-120235Nov 1, 2026Client crash via unbounded SSE bufferingAG-UI Protocol, AG-UI

Public exploitNetwork attack vector

—Unscored

Featured

Unauthenticated administrator takeover via unchecked password reset

Authentication bypass in SmarterTools SmarterMail before 100.0.9511 allows remote attackers to reset a system administrator password. The anonymous force-reset-password endpoint trusts IsSysAdmin and writes NewPassword without authenticating the caller or validating OldPassword. Knowledge or guessing of an administrator username is the only gate, after which the reset credential grants full application administration and command execution as SYSTEM or root.

CVE-2026-23760Known exploitationPublic exploitNetwork attack vectorHinoki check available

Read the full record

Daily unique IPs observed over 30 days

Aug 30, 2026Sep 28, 2026

View daily counts

Reporting day	Unique IPs
Aug 30, 2026	Unavailable
Aug 31, 2026	14
Sep 1, 2026	Unavailable
Sep 2, 2026	Unavailable
Sep 3, 2026	2,148
Sep 4, 2026	Unavailable
Sep 5, 2026	Unavailable
Sep 6, 2026	Unavailable
Sep 7, 2026	Unavailable
Sep 8, 2026	Unavailable
Sep 9, 2026	Unavailable
Sep 10, 2026	Unavailable
Sep 11, 2026	1
Sep 12, 2026	Unavailable
Sep 13, 2026	Unavailable
Sep 14, 2026	Unavailable
Sep 15, 2026	1
Sep 16, 2026	Unavailable
Sep 17, 2026	Unavailable
Sep 18, 2026	Unavailable
Sep 19, 2026	Unavailable
Sep 20, 2026	Unavailable
Sep 21, 2026	2
Sep 22, 2026	Unavailable
Sep 23, 2026	Unavailable
Sep 24, 2026	Unavailable
Sep 25, 2026	Unavailable
Sep 26, 2026	Unavailable
Sep 27, 2026	Unavailable
Sep 28, 2026	15

Shadowserver KEV observations through Sep 28, 2026. Gaps indicate unavailable data.

Observed

Attack activity on the latest reporting day

Shadowserver observations through Sep 28, 2026. Counts describe the reporting day shown on each card.

Sep 28, 2026Authenticated code execution via PowerShell deserialization

CVE-2022-41082KEV

523 unique IPs observed on this reporting day.Sep 28, 2026CVE-2014-8361

CVE-2014-8361KEV

409 unique IPs observed on this reporting day.Sep 28, 2026Command execution via unsanitized ping destination

CVE-2018-10562KEV

361 unique IPs observed on this reporting day.

Rising

Largest increases in observed activity

Compare the 7-day average of daily unique IPs with the preceding, separate 30-day average. A comparison requires complete history and a positive baseline.

01Unauthenticated command execution via forged authorization headers

CVE-2021-22986KEV

2.8×of 30-day average 02Unauthenticated administrator access via null session token

CVE-2021-32030KEV

2.4×of 30-day average 03Session-token disclosure via oversized Host header

CVE-2023-4966KEV

1.5×of 30-day average 04Unauthenticated file disclosure via unchecked GeoJSON URL

CVE-2021-41277KEV

1.5×of 30-day average 05Remote code execution via attacker-controlled JNDI lookups

CVE-2021-44228KEV

1.2×of 30-day average

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Get started to see how Hinoki identifies affected software and validates exploitability in your environment.