Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ChurchCRM

A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-11939 is a path traversal vulnerability identified in ChurchCRM, an open-source church management software, affecting versions 5.0 through 5.18.0. The flaw exists in the Backup Restore Handler component, specifically in the file src/ChurchCRM/Backup/RestoreJob.php. The vulnerability arises from improper validation or sanitization of the restoreFile argument, allowing an attacker to manipulate file paths and traverse directories outside the intended scope. This can lead to unauthorized access to files on the server, potentially exposing sensitive data or enabling further attacks. The vulnerability can be exploited remotely without user interaction but requires the attacker to have high privileges on the system, which limits the attack surface. The CVSS 4.0 score is 5.1 (medium), reflecting the moderate impact and exploitation complexity. The vendor was contacted but has not responded, and no patches have been released yet. Public disclosure of the exploit details increases the risk of exploitation by malicious actors. The vulnerability does not require authentication bypass or user interaction, but the need for high privileges means attackers must already have significant access to the system to exploit it.

Detailed information about CVE-2025-11939: Path Traversal in ChurchCRM affecting null ChurchCRM. Get real-time updates, technical details, and mitigation strate

CVE-2025-11939: Path Traversal in ChurchCRM - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11939: Path Traversal in ChurchCRM

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-11938 is a medium-severity deserialization vulnerability affecting ChurchCRM versions 5.0 through 5.18.0. The flaw exists in the setup/routes/setup.php file, where manipulation of certain input parameters—specifically DB_PASSWORD, ROOT_PATH, or URL—can trigger unsafe deserialization of data. Deserialization vulnerabilities occur when untrusted data is processed by an application’s deserialization routines, potentially allowing attackers to execute arbitrary code, escalate privileges, or cause denial of service. In this case, the vulnerability can be exploited remotely without authentication or user interaction, although the attack complexity is rated high, indicating that exploitation requires significant skill or specific conditions. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges or user interaction needed, and low impact on confidentiality, integrity, and availability. The vendor was notified but has not responded or issued a patch, and no official patch links are available. While no known exploits are currently active in the wild, the public disclosure of the exploit code increases the risk of future attacks. ChurchCRM is a widely used open-source church management system, making this vulnerability relevant to many religious and community organizations globally.

Detailed information about CVE-2025-11938: Deserialization in ChurchCRM affecting null ChurchCRM. Get real-time updates, technical details, and mitigation strat

CVE-2025-11938: Deserialization in ChurchCRM - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11938: Deserialization in ChurchCRM


CVE-2025-11939: Path Traversal in ChurchCRMCVE-2025-11939 0 A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityUnited StatesCanadaUnited Kingdom+6#cve #cve-2025-11939 Join the discussion	CVE Database V5	10/19/2025, 08:02:05 UTC Added: 10/19/2025, 08:08:57 UTC
CVE-2025-11938: Deserialization in ChurchCRMCVE-2025-11938 0 A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityUnited StatesCanadaUnited Kingdom+4#cve #cve-2025-11938 Join the discussion	CVE Database V5	10/19/2025, 07:32:05 UTC Added: 10/19/2025, 07:37:49 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional