Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

dootask

DooTask versions up to 1.9.66 have an authorization bypass vulnerability in the WebSocketDialog::checkDialog() function. This flaw allows authenticated users to bypass membership checks for dialogs with the group_type 'okr'. Exploiting this, users can read and inject messages in OKR comment dialogs via certain message-related endpoints.

CVE-2026-111640 is an authorization bypass vulnerability in kuaifan's DooTask product, affecting versions up to and including 1.9.66. The vulnerability exists in the WebSocketDialog::checkDialog() method, which fails to enforce membership checks for dialogs where group_type is 'okr'. Authenticated users can exploit this by supplying the dialog_id of OKR comment dialogs to the msg__list, msg__one, or msg__send* endpoints, enabling unauthorized reading and injection of messages within those dialogs.

DooTask versions up to 1.9.66 have an authorization bypass vulnerability in the WebSocketDialog::checkDialog() function. This flaw allows authenticated users to bypass membership checks for dialogs with the group_type 'okr'. Exploiting this, users can read and inject messages in OKR comment dialogs 

CVE-2026-111640: Authorization Bypass Through User-Controlled Key in kuaifan dootask

DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.

The vulnerability identified as CVE-2026-29828 affects DooTask version 1.6.27, a project management application. It is a Cross-Site Scripting (XSS) flaw located in the /manage/project/<id> page, specifically through the projectDesc input field. This input field fails to properly sanitize or encode user-supplied data, allowing attackers to inject malicious JavaScript code. When other users access the affected page, the injected script executes in their browsers, potentially leading to session hijacking, theft of sensitive information, or unauthorized actions performed on behalf of the victim. The vulnerability is exploitable remotely over the network without requiring any privileges, but it does require the victim to interact with the malicious content (user interaction). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects that the attack surface is network-based, with low attack complexity, no privileges required, but user interaction is necessary. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component. Confidentiality and integrity impacts are low, while availability is unaffected. No patches or official fixes have been released at the time of publication, and no known exploits have been observed in the wild. The vulnerability is categorized under CWE-79, which is a common web application security weakness related to improper neutralization of input leading to XSS.

Detailed information about CVE-2026-29828: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-29828: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-29828: n/a


CVE-2026-111640: Authorization Bypass Through User-Controlled Key in kuaifan dootaskCVE-2026-111640 0 DooTask versions up to 1.9.66 have an authorization bypass vulnerability in the WebSocketDialog::checkDialog() function. This flaw allows authenticated users to bypass membership checks for dialogs with the group_type 'okr'. Exploiting this, users can read and inject messages in OKR comment dialogs via certain message-related endpoints. MediumVulnerability#cve #cve-2026-111640 #gcve Join the discussion	CVE Database V5	10/16/2026, 18:34:46 UTC Added: 10/16/2026, 17:51:11 UTC
CVE-2026-29828: n/aCVE-2026-29828 0 DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2026-29828 Join the discussion	CVE Database V5	03/20/2026, 00:00:00 UTC Added: 03/20/2026, 16:54:27 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional