Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Emby.Security

Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.

CVE-2025-64113 identifies a critical security vulnerability in Emby Server, a popular user-installable home media server software. The vulnerability stems from a weak password recovery mechanism classified under CWE-640, which allows attackers to bypass authentication controls and gain full administrative access to the Emby Server application interface. This access is limited to the application level and does not extend to the underlying operating system. The vulnerability requires only network access to the server, with no prerequisites such as user interaction or prior authentication, making it highly exploitable remotely. The weakness in the password recovery process likely involves insufficient verification steps or predictable recovery tokens, enabling attackers to reset or retrieve administrative credentials. The issue affects all Emby Server versions below 4.9.1.81, with the vendor having addressed the flaw in that release. The CVSS 4.0 base score is 9.3 (critical), reflecting the vulnerability's ease of exploitation (network attack vector, no privileges or user interaction required) and its severe impact on confidentiality, integrity, and availability of the Emby Server administration. Although no known exploits are reported in the wild yet, the vulnerability's characteristics suggest it could be rapidly weaponized. Organizations running vulnerable Emby Servers risk unauthorized administrative control, which could lead to data exposure, manipulation of media content, and potential pivoting to other internal systems if the server is connected to broader networks.

Detailed information about CVE-2025-64113: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in EmbySupport security affecting EmbySupport securi

CVE-2025-64113: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in EmbySupport security - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-64113: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in EmbySupport security

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.

CVE-2025-64325 is a cross-site scripting vulnerability classified under CWE-79 and CWE-116 affecting Emby Server's web application component, specifically the Emby.Security module. The vulnerability exists because the server fails to properly neutralize input from the X-Emby-Client HTTP header during web page generation. When a malicious actor sends an authentication request with a crafted X-Emby-Client header, this value is incorporated into the devices section of the admin dashboard without adequate sanitization or encoding. This results in the injection of malicious scripts that execute in the context of the administrator's browser when they view the devices section. The vulnerability is exploitable remotely over the network (AV:N), requires low attack complexity (AC:L), no privileges (PR:L - low privileges, meaning an authenticated user with limited rights), and user interaction (UI:A) to trigger the payload. The impact on confidentiality and integrity is high due to potential session hijacking, credential theft, or further exploitation of the admin interface. Availability impact is not significant. The vulnerability affects Emby Server versions prior to 4.8.1.0 and Beta versions prior to 4.9.0.0-beta, and has been patched in these versions. No public exploits have been reported yet, but the vulnerability's nature and high CVSS score indicate a strong potential for exploitation if left unpatched.

Detailed information about CVE-2025-64325: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmbySupport Emby.Secu

CVE-2025-64325: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmbySupport Emby.Security - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-64325: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmbySupport Emby.Security


CVE-2025-64113: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in EmbySupport securityCVE-2025-64113 0 Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81. CriticalVulnerabilityGermanyUnited KingdomFrance+4#cve #cve-2025-64113 #cwe-640 Join the discussion	CVE Database V5	12/09/2025, 19:21:12 UTC Added: 12/09/2025, 19:31:26 UTC
CVE-2025-64325: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmbySupport Emby.SecurityCVE-2025-64325 0 Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta. HighVulnerabilityGermanyUnited KingdomFrance+2#cve #cve-2025-64325 #cwe-79 Join the discussion	CVE Database V5	11/18/2025, 22:32:06 UTC Added: 11/18/2025, 22:40:00 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional