Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

anydesk

An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation.

CVE-2025-27919 is a vulnerability identified in the AnyDesk remote desktop software through version 9.0.4. The flaw allows a remote user who has been granted the 'Control my device' permission to manipulate the remote AnyDesk client’s settings without the knowledge or confirmation of the device owner. Specifically, the attacker can create a password for the Full Access profile on the remote system, which normally requires explicit confirmation from the counterparty. By setting this password covertly, the attacker gains the ability to reconnect to the device later without needing any further approval, effectively establishing persistent unauthorized access. The vulnerability is classified under CWE-284 (Improper Access Control), indicating a failure to enforce proper permission checks. The CVSS v3.1 base score is 8.2 (high severity), with the vector indicating that the attack can be performed remotely over the network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and affects confidentiality significantly (C:H), with limited impact on integrity (I:L) and no impact on availability (A:N). No known exploits are currently reported in the wild, and no patches have been linked yet, suggesting the vulnerability is newly disclosed. This issue poses a serious risk because it undermines the trust model of AnyDesk’s remote access permissions, allowing attackers to escalate their access and maintain persistence stealthily.

Detailed information about CVE-2025-27919: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-27919: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-27919: n/a

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.

CVE-2024-52940 is a vulnerability identified in AnyDesk remote desktop software on Windows platforms up to version 8.1.0. The flaw arises when the 'Allow Direct Connections' feature is enabled, which is intended to facilitate direct peer-to-peer connections for improved performance. However, this feature inadvertently leaks the user's public IP address within the network traffic. The vulnerability is classified under CWE-532, indicating exposure of sensitive information in logs or traffic. An attacker only needs to know the victim's AnyDesk ID to exploit this issue, as no authentication or user interaction is required. The CVSS v3.1 base score is 7.5 (high), reflecting the ease of exploitation over the network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The impact is primarily on confidentiality, as the attacker gains knowledge of the victim's public IP address, which can be used for further reconnaissance, targeted attacks, or privacy violations. There is no direct impact on integrity or availability. Currently, no patches or fixes have been published, and no known exploits have been observed in the wild. This vulnerability highlights the risk of information leakage through network features designed for connectivity optimization.

Detailed information about CVE-2024-52940: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-52940: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-52940: n/a


CVE-2025-27919: n/aCVE-2025-27919 0 An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation. HighVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2025-27919 Join the discussion	CVE Database V5	11/06/2025, 00:00:00 UTC Added: 11/06/2025, 17:23:59 UTC
CVE-2024-52940: n/aCVE-2024-52940 0 AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-52940 Join the discussion	CVE Database V5	11/18/2024, 00:00:00 UTC Added: 02/25/2026, 21:38:04 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional