Loading the latest data…
Exploited · Breached · CompromisedLoading
The vulnerabilities attackers are using today, the breaches and the poisoned software: whether a fix exists, and the first thing to do. In plain language, checked every hour against CISA, ENISA, the Belgian CCB and the security press.
Loading the latest data…
How it works
Thousands of vulnerabilities are published every month. A few dozen are actually used by attackers. Wildcard Watch shows those, plus the breaches and supply-chain attacks that hit organisations like yours, in plain language and with the first step to take. Every item links to its sources.
Official catalogues come late: attackers often move days before CISA lists a flaw. So we also watch the early signs, and show them on every item as a timeline: talk on the security mailing lists (oss-security, Full Disclosure), how many people discuss it on Bluesky and Hacker News, public exploit code (Exploit-DB, Metasploit, proof-of-concept repositories on GitHub), scanner templates (Nuclei; once one exists, mass scanning usually follows), reports from sensor networks that see attack attempts (research by GreyNoise), then the press, the CCB and CERTs, and finally the official catalogues.
Early signals are not confirmations. They make an item more urgent when it is already exploited, and they put serious flaws On the radar before any attack is reported. They never trigger an alert on their own, and talk on social media never makes an item more urgent: it only tells you people are paying attention. We count proof-of-concept repositories on GitHub but do not link them: fake exploits that carry malware are common. Never run exploit code to test your own systems.
We combine official catalogues (CISA's Known Exploited Vulnerabilities, ENISA's EU Vulnerability Database, the CVE Program), warnings from the Centre for Cybersecurity Belgium and CERT-EU, vendor security advisories, and the security press. From news sites we take only the headline and the link; the words on this site are our own or come from the CVE record. Every item lists its sources.
Behind the scenes we also use FIRST's exploit prediction score (EPSS) as one of the signals for "Patch now". We do not show it as a number: on its own, without your context, it misleads more than it helps.
It is not security advice for your situation, and it does not know your network. It tells you what attackers use; whether it matters to you depends on what you run and how it is exposed. Pick your stack to filter, and always check the vendor advisory before you act.
No cookies, and no tracking of individuals. We count visits with Plausible, which uses no cookies and keeps no personal data. "My stack" lives in your own browser only. If you subscribe to alerts, Wildcard Group keeps your email address, your choices and the date and wording of your consent, only to send these alerts. You confirm your address first, every email has an unsubscribe link, and when you unsubscribe we stop at once and delete your data within 30 days. Questions: info@wildcardgroup.be.
To see how much a vulnerability is discussed, we count public posts on Bluesky and Hacker News that name it. We keep only numbers per day: how many posts and how many different accounts. We do not store names, handles or the posts themselves, we leave out bots and people who asked not to be shown to logged-out visitors, and we link to the platform's own search or discussion page.
Wildcard Group is a Belgian security partner: readiness and resilience, insider risk and investigations, executive and VIP digital protection, digital forensics and incident response, advisory and training. We built Watch because the people we work with drown in vulnerability news and need one answer: what do I do first. wildcardgroup.be