Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

SANS ISC Handlers Diary

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

rustls

CVE-2026-108266 is an origin validation error in the Privasys rustls fork prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This allowed an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, potentially causing a relying party to accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1.

Privasys rustls, a fork of the rustls TLS library adding RA-TLS challenge and channel-binding support, had a vulnerability (CWE-346) in versions prior to 0.8.1. The RA-TLS challenge certificates generated did not bind the quote ReportData to the active TLS session, only to the certificate public key and client nonce. This flaw allowed an attacker who obtained an enclave TLS private key to relay a genuine RA-TLS quote onto a different TLS connection. As a result, a relying party could be tricked into accepting a connection terminated by an attacker as if it were from the attested enclave. The vulnerability is addressed by the fix introduced in version 0.8.1.

CVE-2026-108266 is an origin validation error in the Privasys rustls fork prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This allowed an attacker with 

CVE-2026-108266: CWE-346: Origin Validation Error in Privasys rustls

A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

CVE-2024-11738 is a vulnerability identified in Rustls version 0.23.13, a popular Rust-based TLS library used for secure communications. The flaw arises from improper handling of fragmented TLS ClientHello messages, which leads to an uncaught exception causing the Rustls library to panic and crash the application using it. Specifically, when a fragmented ClientHello message is received, the library fails to correctly process the fragments, resulting in a denial of service (DoS) condition. This vulnerability does not compromise the confidentiality or integrity of the TLS session but impacts availability by causing the affected service to terminate unexpectedly. The vulnerability can be exploited remotely without any authentication or user interaction, making it accessible to any attacker capable of sending crafted TLS handshake messages. The CVSS v3.1 base score is 5.3, indicating a medium severity level. No public exploits or active exploitation have been reported to date. Rustls is widely used in various applications and services written in Rust, including web servers, proxies, and embedded systems, making this vulnerability relevant to a broad range of deployments. The root cause is a lack of robust input validation and error handling for fragmented handshake messages within the TLS protocol implementation. The vulnerability was reserved on 2024-11-26 and published on 2024-12-06. No official patches or fixes are linked yet, but upgrading to a fixed Rustls version once released is the primary remediation.

Detailed information about CVE-2024-11738: Uncaught Exception. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-11738: Uncaught Exception - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-11738: Uncaught Exception


CVE-2026-108266: CWE-346: Origin Validation Error in Privasys rustlsCVE-2026-108266 0 CVE-2026-108266 is an origin validation error in the Privasys rustls fork prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This allowed an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, potentially causing a relying party to accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1. CriticalVulnerability#cve #cve-2026-108266 #cwe-346 Join the discussion	CVE Database V5	10/09/2026, 21:00:19 UTC Added: 10/09/2026, 21:19:08 UTC
CVE-2024-11738: Uncaught ExceptionCVE-2024-11738 0 A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-11738 Join the discussion	CVE Database V5	12/06/2024, 14:54:11 UTC Added: 11/20/2025, 18:33:15 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional