Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2025-12050 is a high-severity vulnerability in Insyde Software's InsydeH2O tools involving an out-of-bounds write (CWE-787) caused by improper handling of registry data. The vulnerable drivers use the RTL_QUERY_REGISTRY_DIRECT flag to read registry values, which can be manipulated by a low-privileged user-mode application to trigger a buffer overflow. This flaw allows an attacker with limited privileges to escalate their rights and execute arbitrary code with elevated privileges, impacting confidentiality, integrity, and availability. No user interaction is required, but local privileges are needed to exploit. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to systems using affected InsydeH2O versions. European organizations relying on devices with Insyde firmware, especially in countries with high market penetration of OEMs using Insyde BIOS, are at risk. Mitigation involves applying vendor patches once available, restricting local user permissions, and monitoring for suspicious registry access patterns. Countries like Germany, France, and the UK are likely most affected due to their large enterprise and manufacturing sectors using such hardware. The CVSS score of 7. 8 reflects the high impact and moderate attack complexity of this vulnerability.

CVE-2025-12050 is a vulnerability classified under CWE-787 (Out-of-bounds Write) affecting Insyde Software's InsydeH2O tools, specifically in the drivers that utilize the RTL_QUERY_REGISTRY_DIRECT flag to read registry values. This flag is used to query the Windows registry directly, but the implementation in the affected drivers fails to properly validate or bound-check the data read from the registry. An untrusted user-mode application with limited privileges can manipulate the registry values to cause a buffer overflow in the kernel-mode driver. This out-of-bounds write can corrupt memory, potentially allowing an attacker to execute arbitrary code with elevated privileges, escalate local privileges, or cause system instability and denial of service. The vulnerability requires local access with low privileges (PR:L) but does not require user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component. The CVSS v3.1 score of 7.8 indicates high severity due to the combined high impact on confidentiality, integrity, and availability, and relatively low attack complexity. No public exploits are currently known, but the vulnerability is critical enough to warrant immediate attention. The affected product, InsydeH2O, is a widely used BIOS/UEFI firmware solution embedded in many OEM devices, making this a significant supply chain risk. The lack of available patches at the time of publication necessitates interim mitigations and heightened monitoring.

Detailed information about CVE-2025-12050: CWE-787 Out-of-bounds Write in Insyde Software InsydeH2O tools affecting Insyde Software InsydeH2O tools. Get real-ti

CVE-2025-12050: CWE-787 Out-of-bounds Write in Insyde Software InsydeH2O tools - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-12050: CWE-787 Out-of-bounds Write in Insyde Software InsydeH2O tools

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

The vulnerability CVE-2026-22686 affects the agentfront enclave-vm, a secure JavaScript sandbox designed to safely execute AI agent code within Node.js environments. Prior to version 2.7.0, enclave-vm improperly exposes a host-side Error object to sandboxed code when a tool invocation fails. This Error object retains its host realm prototype chain, which can be traversed by malicious sandboxed code to reach the host Function constructor. By intentionally triggering a host error, an attacker can climb this prototype chain and use the Function constructor to compile and execute arbitrary JavaScript code in the host Node.js runtime context. This effectively breaks the sandbox's core security guarantee of isolating untrusted code, allowing full access to sensitive host resources such as process environment variables, filesystem, and network interfaces. The vulnerability is categorized under CWE-693 (Protection Mechanism Failure) and CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 10.0 (critical), reflecting the vulnerability's ease of exploitation (no privileges or user interaction required), network attack vector, and complete impact on confidentiality, integrity, and availability. The issue was publicly disclosed on January 13, 2026, and fixed in enclave version 2.7.0. No known exploits have been reported in the wild to date.

Detailed information about CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave affecting agentfront enclave. Get real-time updates, tech

CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.

CVE-2026-0716 is a vulnerability identified in the libsoup library, specifically in its WebSocket frame processing component used by Red Hat Enterprise Linux 10. The flaw arises when the library handles incoming WebSocket messages under a non-default configuration where the maximum incoming payload size is not set. In this scenario, libsoup may read memory beyond the intended buffer boundaries, leading to out-of-bounds memory access. This can result in unintended exposure of memory contents or cause the application to crash due to memory corruption. The vulnerability does not require authentication or user interaction but does require network access to exploit, as it involves processing incoming WebSocket frames. The CVSS 3.1 base score is 4.8 (medium), with the vector indicating network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), limited confidentiality impact (C:L), no integrity impact (I:N), and low availability impact (A:L). No known public exploits have been reported to date. The vulnerability affects applications that utilize libsoup’s WebSocket support with the specific configuration of an unset maximum payload size, which may not be the default setting. This suggests that only certain deployments or custom configurations are vulnerable. The flaw is significant because WebSocket is widely used for real-time web communications, and libsoup is a common HTTP client/server library in Linux environments. Exploitation could lead to information disclosure or denial of service via application crashes. Red Hat Enterprise Linux 10 users should review their libsoup configurations and apply patches once available to prevent exploitation.

Detailed information about CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10 affecting Red Hat Red Hat Enterprise 

CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

CVE-2026-23478 is a critical security vulnerability identified in the open-source scheduling software cal.com, affecting versions from 3.1.6 up to but not including 6.0.7. The root cause lies in a custom NextAuth JWT callback implementation that improperly enforces security controls on the client side rather than the server side. Specifically, the session.update() function accepts a target email address parameter without adequate server-side validation, enabling an attacker to impersonate any user by supplying their email address. This bypasses authentication mechanisms, granting the attacker full authenticated access to the victim's account. The vulnerability is classified under CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates the vulnerability is remotely exploitable over the network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and results in high confidentiality, integrity, and availability impacts (VC:H, VI:H, VA:H). The scope is high (S:H), meaning the vulnerability affects resources beyond the initially vulnerable component. Although no known exploits are reported in the wild yet, the critical severity and ease of exploitation make it a significant threat. The vulnerability is resolved in cal.com version 6.0.7 by enforcing proper server-side validation of session updates and restricting unauthorized email parameter manipulation.

Detailed information about CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com affecting calcom cal.com. Get real-time up

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com

NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.

CVE-2025-68947 identifies a missing authorization vulnerability (CWE-862) in the NSecsoft NSecKrnl Windows driver. NSecKrnl is a kernel-mode driver that facilitates certain system-level operations. The vulnerability allows a local attacker with low privileges to send specially crafted IOCTL (Input Output Control) requests to the driver, bypassing authorization checks. This enables the attacker to terminate processes owned by other users, including highly privileged SYSTEM processes and Protected Processes, which are normally shielded from termination to maintain system stability and security. The flaw arises because the driver fails to verify whether the requesting user has sufficient permissions to perform process termination operations. Exploiting this vulnerability does not require user interaction but does require local authenticated access, limiting remote exploitation. The CVSS v3.1 score of 4.7 reflects the medium severity, with attack vector local (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and impact limited to availability (A:H) without affecting confidentiality or integrity. No patches or known exploits are currently available, but the vulnerability poses a risk of denial of service or disruption by terminating critical system processes.

Detailed information about CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NSecKrnl affecting NSecsoft NSecKrnl. Get real-time updates, technical deta

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

CVE-2025-12050: CWE-787 Out-of-bounds Write in Insyde Softwa...

CVE-2026-22686: CWE-693: Protection Mechanism Failure in age...

CVE-2026-0716: Buffer Access with Incorrect Length Value in ...

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-S...

CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NS...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility