ZeroDayCN maintains the only English-accessible, continuously indexed record of zero-day and in-the-wild exploits across the Chinese threat landscape — 1,840+ CVEs, 312 named APT groups, and triage-ready advisories delivered an average of 19 hours ahead of NVD publication.
The database is a working terminal, not a marketing table. Filter by vendor, CVE year, APT attribution, EPSS score, or in-the-wild status — then export to your stack.
What you see here is advisory-grade data pulled from the production feed. Every row carries ZeroDayCN's advisory timestamp and lead time over public NVD publication.
Sample rows drawn from public advisories — production feed updates every 7 minutes. False-positive rate: 4.7% (cited, never claimed as zero).
Open the DatabaseZeroDayCN exports the same shape your SIEM, SOAR, and XDR pipelines already parse. No custom parser, no swivel-chair triage — advisory hits Splunk, Sentinel, Elastic, or QRadar in the schema your detections expect, and lands as a STIX 2.1 bundle on your TAXII 2.1 collection within 12 minutes of confirmation.
Integrated feeds ship inside Splunk Enterprise Security, Microsoft Sentinel, Elastic Security, IBM QRadar, Chronicle SecOps, Sumo Logic, Devo, LogRhythm, and OpenSearch — no extra index, no extra license.
Every CVE and APT object is published simultaneously as a STIX 2.1 bundle, a MISP Galaxy cluster, a TAXII 2.1 collection envelope, plus raw JSON and CSV — pick the one your pipeline consumes, ignore the rest.
Enterprise subscribers get a 600 req/min ceiling, OAuth 2.0 client-credentials, and a 99.95% uptime SLA — backed by the same 24/7 hotline that pages analysts with a 12-minute median response time.
Fourteen plug-and-play playbook packs translate a confirmed zero-day advisory into containment actions — host isolation, IOC blocklists, EDR sweep, identity-revocation — without an analyst writing a single line.
Cross-reference 1,840+ cataloged vulnerabilities against 312 named Chinese-nexus APT groups and gray-market exploit vendors — the relationship graph that turns a CVE alert into a who, a how, and a why-it-matters. Four samples below from the live index.
Long-running espionage cluster tied to Microsoft, Google, and HPE disclosures. Database carries every one of their public exploit families back to 2018 with the IOC bundle pre-staged for Splunk and Sentinel.
Tracked since the 2024 leak corpus. Every CVE Anxun resold to MSS-adjacent buyers is fingerprinted in the database with the original exploit author, the resale chain, and a confidence rating.
Southeast Asian and EU diplomatic targeting. The database resolves each linked CVE to a specific PlugX, KorPlug, or ToneShell variant, with the implant's TTPs cross-walked to ATT&CK.
A gray-market broker cluster brokering exclusive access to N-day and zero-day exploits sourced from Chinese independent researchers. Each linked CVE carries a non-attribution caveat and a confidence rating.
ZeroDayCN's catalog is sourced from four primary channels: an in-house honeypot array spanning 14 ISPs across mainland China and three Southeast Asian PoPs; a private sandbox cluster running daily triage of suspicious samples submitted by enterprise subscribers; a responsible-disclosure intake that has coordinated 230+ vendor patches with Microsoft, Apple, Google, and Huawei security teams; and direct research output from the team's 11 senior vulnerability researchers — alumni of Qihoo 360, NSFocus, and Pangu Lab with 140+ years of combined experience.
Each candidate CVE passes a four-stage validation pipeline before publication. First, a static and dynamic analysis pass against the in-house sandbox to confirm exploitability and reproducibility. Second, a vendor-notification handshake — we hold publication until the vendor has confirmed or 72 hours have elapsed, whichever comes first. Third, a peer review by at least two senior researchers outside the original discoverer. Fourth, a confidence rating from 1 to 5 with the rationale recorded in the advisory metadata. We cite our false-positive rate at 4.7% across the 1,840+ cataloged entries in 2024 — not zero, because zero is a lie your SOC team would catch inside a week.
The cross-reference layer between CVEs and the 312 tracked Chinese-nexus APT and gray-market exploit vendors is built and maintained by a separate team of 6 threat intelligence analysts, with attribution confidence scores reviewed quarterly. We do not assert state affiliation beyond what open-source reporting already supports, and we do not publish exploit binaries, weaponized proof-of-concept code, or hacking-as-a-service offerings. What we publish is validated intelligence — the kind that survives a SOC2 audit and a procurement review.
