Modat

⚠️ Active exploit. of SolarWinds Web Help Desk. Internet‑exposed WHD hit via unauth RCE. Attackers use Zoho RMM for persistence, Velociraptor for C2/recon/exfil, Cloudflare for access, then disable Defender/firewall. WHD <12.8.7 HF1 is vulnerable. Patch 2026.1+ Magnify Query: web.html.mmh3=1424519104

⚠️CVE-2026-25253: 1-click RCE in OpenClaw. A crafted link leaks gateway tokens via WebSocket, enabling host command execution even on localhost. Fixed v2026.1.29 patch & rotate tokens. Query: web.title~"Clawdbot Control" OR web.title~"OpenClaw Control" OR web.title~"Moltbot Control" 
magnify.modat.io

Moldbot Unmasked: A Global Deployment Analysis mDNS Broadcasts Leak: Our findings indicate that Moltbot instances are routinely exposing far more information via mDNS than expected, posing a significant configuration risk for global infrastructure...

Latest research: Moldbot exposed across 53 countries. 

1,487 hosts leaking data via mDNS, 635 public control panels, and credential artifacts tied to Signal, Telegram & WhatsApp. 
Full research👉 www.modat.io/post/moldbot...

⚠️ CISA added CVE-2026-24858 to its KEV catalog after active exploitation of Fortinet FortiOS via FortiCloud SSO. An auth bypass lets attackers with a FortiCloud account access other tenants’ devices, enabling admin access and config abuse. Patch now. Modat Magnify Query: os="FortiOS" product~"Forti"

⚠️ CISA added CVE‑2024‑37079 to its KEV catalogue after confirmed in‑the‑wild exploitation of VMware vCenter Server. An out‑of‑bounds write in the DCE/RPC protocol allows unauthenticated network‑based RCE via crafted packets. Patch immediately.

Modat Magnify Query: product="VMware vCenter"

⚠️ CVE-2026-21962 (CVSS 10.0) impacts Oracle Fusion Middleware, including Oracle HTTP Server and WebLogic Proxy Plug-Ins. Unauthenticated attackers can gain full system control and pivot across environments. Apply Oracle’s January 2026 Critical Patch Update immediately.

⚠️ CISA has added CVE-2025-8110 to its KEV catalog after active exploitation of public-facing Gogs instances. The flaw bypasses a prior RCE fix via improper symlink handling, allowing authenticated attackers to overwrite files and achieve remote code execution. Modat Magnify Query: technology="Gogs"

Cyber Monday Deal 
Get 6 months of Modat Magnify Pro for just €5 total (save €355). 
Use code: MODAT2025CYBERMONDAY 
 
Try the platform. Run advanced queries. Find what others miss. 

magnify.modat.io

#CyberMonday #Cybersecurity #OSINT

We publish all IPs and you can view here:

scanner.modat.io

Exposed to the Bare Bone: When Private Medical Scans Surface on the Internet Globally Impactful Research: 1.2 Million Healthcare Devices and Systems Available on the Open Internet. European cybersecurity company Modat reveals that exposed internet-connected devices are resul...

New Research – Global Impact: Over 1.2 million internet-connected healthcare devices and systems with exposure that endanger patient data.  
Findings across 70+ different types of medical devices & systems: MRI, CT, X-rays, hospital management systems, others 
 
👉 Read the full blog:
bit.ly/4fqfKrv

🚨 Cisco fixed CVE-2025-20309 — a root-level backdoor in Unified CM.
Affected users must update to 15 SU3 or patch now.

Try this query:
one_service(product="Cisco UCS Manager") and one_service(port=22 service=ssh)

The platform: magnify.modat.io

#Modat #CVE202520309 #ModatMagnify #Cisco

🚨 Citrix fixes critical NetScaler bug CVE-2025-5777—patch ASAP.
Out-of-bounds flaw similar to CitrixBleed may expose session token.
Affects gateway-configured devices.
Upgrade + kill active sessions.

#citrix #CVE-2025-5777 #modat #modatmagnify
Try this query:
magnify.modat.io/search?query=p…

🚨 New Feature Finding:

Using Device DNA Tag Water Management, we uncovered exposed pump controllers in wastewater systems. A potential gateway for disruption.

Platform: magnify.modat.io

Post: www.linkedin.com/feed/update/...

Modat - Stop Searching, Start Finding - DNA dataset Modat Magnify gives you access to the largest internet device DNA dataset available. Designed by and for Offensive and Defensive cybersecurity professionals. Experience unparalleled speed, contextual ...

New in Modat Magnify v1.2.0:

• Host-level search
• AI Query Assistant
• Wildcard DNS search

🧠 Try it free: bit.ly/3ZpvmER

#ModatMagnify #CyberSecurity #ThreatIntel

🚦 We found exposed traffic control systems online — and the risk isn’t just red lights.
Read how attackers could disrupt urban safety in our latest research using Modat Magnify:

tinyurl.com/2jpnhzxe

#ModatMagnify #CyberSecurity #SmartCities #FeatureFinding

🚨 CVE-2025-3248 in Langflow is under active exploitation. 
Unauth RCE via exposed endpoint. 

Try with Modat Magnify: 
Run → product="Langflow" 
 
magnify.modat.io 

#Langflow #CVE-2025-3248 #RCE #ModatMagnify #CyberSecurity #CISA #VulnerabilityAlert #LLM #RemoteCodeExecution #Infosec #ThreatIntel

🚨 CVE-2025-2905: XXE vuln in WSO2 API Manager v2.0.0 & older. 
Unauthorisez attackers can read files or DoS your service. 

Try with Modat Magnify: 
Run this query → web.title="WSO2 API Manager" 
magnify.modat.io 

 Free access until July 1 
#CVE-2025-2905 #XXE #ModatMagnify #ThreatIntel #Infosec

🚨 CVE-2025-31324 in SAP NetWeaver allows unauth RCE via file upload.

Try with Modat Magnify:
Run → product="SAP NetWeaver"

magnify.modat.io

#ModatMagnify #CVE-2025-31324 #CyberSecurity

🚨 CVE-2025-3616 in Greenshift WP plugin allows RCE via subscriber uploads. 

Update to v11.4.6+ now. 

Try with Modat Magnify: 

Run → technology="WordPress" web.html~"greenshift" 
magnify.modat.io 


#ModatMagnify #WordPress #RCE #CVE-2025-3616

🚨CVE-2025-30406 is under active exploit — 7 orgs hit. 
Update CentreStack & Triofox now. 

Try with Modat Magnify: 
Run → web.headers~"Set-Cookie: y-glad-state" 
magnify.modat.io 

#ModatMagnify #CyberSecurity #RCE #CVE202530406 #ModatMagnify #CentreStack #Triofox #VulnerabilityAlert #PatchNow

🚨 New Series Modat Magnify: Feature Findings
Kicking series off w/ Case Management ‘Device DNA’ tag. Relevant research for National & Government CSIRTs
See our findings & further research: bit.ly/3EcA5SZ 
Tag discoveries w/ #ModatMagnify #research #certs #CSIRT #cybersecurity

🚨 CVE-2025-2805 - Critical WordPress plugin flaw

ORDER POST plugin (≤2.0.2) lets unauth attackers run arbitrary shortcodes in WP. 
RCE possible. 

Check exposure with Modat Magnify: 
technology=Wordpress 

magnify.modat.io 

#WordPress #CVE20252805 #Infosec #ModatMagnify

🚨 CVE-2024-48887 — Critical FortiSwitch flaw (CVSS 9.3) 
 
Affected: 6.4.0–7.6.0 
Patch ASAP or disable HTTP/HTTPS admin access. 
Find exposed assets with Modat Magnify: 
cert~"FortiSwitch" 
 
magnify.modat.io 
 
#CVE-2024-48887 #Fortinet #FortiSwitch #Cybersecurity #Infosec #Vulnerability #PatchNow

🚨 CVE-2025-2704
A critical OpenVPN flaw lets attackers crash servers or run remote code. Over 3.2M services at risk.

Check exposure with Modat Magnify, try using this query:
protocol=openvpn

Start here: magnify.modat.io

#CVE20252704 #OpenVPN #Cybersecurity #ModatMagnify #OSINT #Vulnerability

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) | Google Cloud Blog

🚨CVE-2025-22457  
@Mandiant confirms critical Ivanti Connect Secure RCE vulnerability 
📌CVE: bit.ly/4iTpKdD  
📊136K+ services found magnify.modat.io  
Basic Query bit.ly/3E50TEB 
Device DNA bit.ly/4jcSuOV 
#ModatMagnify #CVE202522457 #Ivanti #ThreatIntel #UNC5221 #APT #DFIR

Query for Modat Magnify. New alert.

Modat Magnify Alert: 
We’ve identified ~2,500 exposed CrushFTP instances worldwide. 
According to @shadowserver.bsky.social ~1,800 may be vulnerable to CVE-2025-2825 (CVSS 9.8) — an auth bypass via HTTP(S) that can be exploited
magnify.modat.io/search?query... 

#ModatMagnify #crushftp #infosec #cve

New Device DNAs just dropped on Modat Magnify:
🖥️ KVM over IP (NanoKVM, JetKVM, PiKVM)
🛠️ BMC (e.g. Supermicro)

Available for Pro+ users.
→ magnify.modat.io
#Cybersecurity #ThreatHunting #ModatMagnify #DFIR

Findings from Modat Magnify platform CVE-2025-29927 (CVSS 9.1) Next.js Middleware Bypass Vulnerability  

‼️Critical Vulnerability Alert‼️ 
CVE-2025-29927 (CVSS 9.1) @nextjs.org Middleware Bypass Vulnerability  
Query Below👇  
🔗 Modat Magnify found 376K at-risk devices:
magnify.modat.io/search?query...  
📝  References: 
nextjs.org/blog/cve-202...
nvd.nist.gov/vuln/detail/...

#cve2025_29927 #zerotrust

Find What You Are Looking For Introducing Modat Magnify Stop searching and start finding. Modat Magnify gives you access to the largest Internet ‘Device DNA’ dataset available.

🚀 Introducing Modat Magnify: Access the Largest Internet ‘Device DNA' Dataset

Launching Modat Magnify, AI-powered and research-driven. Designed by and for cybersecurity pros. Stop searching and start finding.

🔗 Get started for FREE: www.modat.io/post/introdu...
#Cybersecurity #ModatMagnify #Modat

Over 49,000 misconfigured building access systems exposed online Researchers discovered 49,000 misconfigured and exposed Access Management Systems (AMS) across multiple industries and countries, which could compromise privacy and physical security in critical sectors.

Researchers discovered 49,000 misconfigured and exposed Access Management Systems (AMS) across multiple industries and countries, which could compromise privacy and physical security in critical sectors.