Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

14Finger

14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload.

CVE-2024-37770 is a critical security vulnerability identified in version 1.1 of the 14Finger biometric software. The flaw exists in the fingerprint processing function, where improper input validation allows attackers to craft malicious payloads that lead to remote command execution (RCE). This vulnerability is categorized under CWE-94, indicating code injection due to unsafe evaluation or execution of user-supplied input. Exploitation requires no authentication and no user interaction, making it highly accessible to remote attackers over the network. The CVSS 3.1 base score of 9.1 reflects the ease of exploitation combined with the severe impact on confidentiality and integrity of affected systems. Attackers can leverage this vulnerability to execute arbitrary commands, potentially gaining full control over the compromised host. Although no public exploits or patches have been reported yet, the critical nature of this vulnerability demands immediate attention from organizations using 14Finger v1.1. The lack of available patches necessitates temporary mitigations and monitoring to reduce risk until a fix is released.

Detailed information about CVE-2024-37770: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-37770: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-37770: n/a

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.

CVE-2024-37769 is a critical security vulnerability identified in version 1.1 of the 14Finger software. The root cause is insecure permission settings that allow an attacker with normal user privileges to escalate their privileges to Administrator by sending a specially crafted POST request to the application. This vulnerability falls under CWE-278, which relates to improper enforcement of permissions, indicating that the software fails to adequately restrict access to privileged functions. The CVSS v3.1 base score is 8.8, reflecting high severity due to the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), requirement of privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Exploiting this flaw allows attackers to gain full control over the affected system, potentially leading to data theft, system manipulation, or denial of service. Although no public exploits have been reported yet, the vulnerability's characteristics make it a prime candidate for future exploitation. The absence of available patches necessitates immediate attention to mitigate risks. The vulnerability affects all installations of 14Finger v1.1, though specific affected versions are not detailed. Organizations relying on this software should prioritize vulnerability assessments and implement network-level restrictions or monitoring to detect suspicious POST requests targeting privilege escalation.

Detailed information about CVE-2024-37769: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-37769: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-37769: n/a

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request.

CVE-2024-37767 is a vulnerability identified in the 14Finger software version 1.1, specifically affecting the /api/admin/user component. The root cause is insecure permissions that allow unauthenticated attackers to send crafted GET requests to this API endpoint and retrieve all user information stored or managed by the system. This vulnerability is classified under CWE-306, which denotes missing authentication for critical functions. The vulnerability is remotely exploitable over the network without requiring any privileges or user interaction, making it highly accessible to attackers. The CVSS 3.1 score of 7.5 reflects a high severity primarily due to the complete compromise of confidentiality, while integrity and availability remain unaffected. The lack of authentication enforcement on an administrative API endpoint is a critical security oversight, exposing sensitive user data to unauthorized parties. Although no public exploits or patches are currently available, the vulnerability poses a significant risk to organizations using this software. The absence of a patch necessitates immediate compensating controls to prevent exploitation. This vulnerability highlights the importance of enforcing strict access controls and authentication mechanisms on all administrative interfaces, especially APIs that expose sensitive user data.

Detailed information about CVE-2024-37767: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2024-37770: n/aCVE-2024-37770 0 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload. CriticalVulnerabilityUnited StatesGermanySouth Korea+7#cve #cve-2024-37770 Join the discussion	CVE Database V5	07/10/2024, 00:00:00 UTC Added: 02/25/2026, 21:41:03 UTC
CVE-2024-37769: n/aCVE-2024-37769 0 Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-37769 Join the discussion	CVE Database V5	07/05/2024, 00:00:00 UTC Added: 02/25/2026, 21:41:03 UTC
CVE-2024-37767: n/aCVE-2024-37767 0 Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-37767 Join the discussion	CVE Database V5	07/05/2024, 00:00:00 UTC Added: 02/25/2026, 21:41:03 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional