Zero-Day Tracker — Active & Recently Disclosed Zero-Day Vulnerabilities | SECMONS

The SECMONS Zero-Day Tracker monitors publicly disclosed zero-day vulnerabilities and confirmed in-the-wild exploitation events. This tracker provides structured, verified intelligence for defenders.

Zero-Day Tracker at SECMONS 🚨

The Zero-Day Tracker monitors publicly disclosed vulnerabilities that were exploited before a patch was available — or were confirmed as actively exploited at the time of disclosure.

This tracker is designed for:

Security operations teams
Vulnerability management teams
Incident responders
Security leadership
Risk owners

It provides structured intelligence — not speculation.

For foundational definitions, see:

What SECMONS Means by “Zero-Day” 🧠

A vulnerability is treated as zero-day when:

Exploitation occurred before a patch was available, OR
The vendor confirmed active exploitation at disclosure, OR
A government advisory identified it as exploited at disclosure

We do not classify vulnerabilities as zero-day based on rumor or unverified claims.

Absence from this tracker does not imply absence of exploitation.

What This Tracker Is Not ⚠️

SECMONS:

Does not claim access to undisclosed vulnerabilities
Does not publish private exploit details
Does not disclose sensitive technical information
Does not provide exploit code
Does not provide weaponization instructions

All entries are based on publicly available, verifiable information.

Governance references:

How Entries Are Added 📊

An entry may be added when:

A vendor confirms exploitation at disclosure
A national authority lists it as actively exploited
Credible research confirms in-the-wild activity
Public evidence demonstrates pre-patch exploitation

Each entry links to a full vulnerability record under:

/vulnerabilities/

That record includes:

CVE metadata
Patch information
Affected versions
Timeline
Risk interpretation
Defensive guidance

Why Zero-Day Tracking Matters 🎯

Zero-day exploitation significantly increases risk because:

Patching lag creates exposure windows
Detection signatures may not yet exist
Threat actors often chain exploits rapidly
Campaign acceleration is common

Zero-days frequently correlate with:

Targeted campaigns
High-value infrastructure targeting
Credential harvesting operations
Privilege escalation chains

See related:

How to Use This Tracker 🧭

For Vulnerability Management Teams 🛠️

Prioritize patch deployment
Identify exposed internet-facing services
Validate patch enforcement and restart requirements

For SOC Teams 🛰️

Increase monitoring around affected services
Hunt for post-exploitation behavior
Correlate suspicious authentication activity

For Security Leadership 📈

Assess exposure window risk
Communicate urgency to stakeholders
Align remediation timelines with real-world exploitation

Update & Review Policy 🔄

Zero-day entries may be updated to reflect:

Patch release changes
Exploitation status clarification
Government advisory inclusion
Additional confirmed targeting

The lastmod field reflects editorial update.

Historical state preservation is not guaranteed unless explicitly archived.

Browse Active & Historical Zero-Days 🔗

Explore detailed records in:

/vulnerabilities/
Filter by exploited status
Review campaign context in /research/
Map associated actors under /threat-actors/

For alerts and ongoing updates:

/news/