Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

hmailserver

Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.

CVE-2025-52374 is a medium-severity vulnerability affecting hMailServer versions 5.8.6 and 5.6.9-beta. The issue arises from the use of a hardcoded cryptographic key within the Encryption.cs component of the software. This key is used to encrypt passwords stored in the hMailAdmin.exe.config file, which contains credentials for connecting to other hMailServer admin consoles. Because the cryptographic key is hardcoded and thus publicly known or easily extractable, an attacker with limited privileges (requiring user interaction and some level of privilege) can decrypt these stored passwords. This enables unauthorized access to other hMailServer admin consoles configured in the environment. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key), which is a known weakness that undermines the confidentiality of sensitive data. The CVSS 3.1 base score is 4.6, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality and integrity but not availability. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability could be exploited by attackers who gain access to a system user account with privileges to read the configuration file and execute the hMailAdmin.exe application, potentially through phishing or insider threats. Once exploited, the attacker can escalate their access to multiple mail server admin consoles, potentially compromising email infrastructure and sensitive communications.

Detailed information about CVE-2025-52374: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-52374: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-52374: n/a

Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.

CVE-2025-52373 is a medium severity vulnerability identified in hMailServer versions 5.8.6 and 5.6.9-beta. The root cause is the use of a hardcoded cryptographic key within the BlowFish.cpp component of the software. This key is used to encrypt passwords stored in the hMailServer.ini configuration file, specifically those related to database connections. Because the cryptographic key is hardcoded and thus publicly known or easily recoverable, an attacker with access to the configuration file can decrypt these passwords. The vulnerability requires the attacker to have at least low-level privileges (PR:L) and some user interaction (UI:R), but it does not require physical or local access to the server, as the attack vector is network-based (AV:N). The vulnerability impacts confidentiality and integrity to a limited extent, as it exposes sensitive database credentials that could be used to further compromise the mail server or connected systems. However, it does not directly affect availability. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key), which is a known poor security practice that undermines encryption effectiveness. No public exploits are currently known in the wild, and no patches have been linked yet. The CVSS v3.1 base score is 4.6, reflecting a medium severity level due to the combination of network attack vector, required privileges, and user interaction. This vulnerability highlights the risk of embedding static cryptographic keys in software, which can be extracted and abused by attackers to bypass encryption protections on sensitive configuration data.

Detailed information about CVE-2025-52373: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-52373: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-52373: n/a

An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components.

CVE-2025-52372 is a medium-severity vulnerability identified in hMailServer version 5.8.6. The issue allows a local attacker to obtain sensitive information by accessing specific configuration files, namely hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini. These files typically contain configuration details and potentially sensitive parameters related to the mail server's installation and operation. The vulnerability is classified under CWE-200, which corresponds to information exposure. The CVSS v3.1 base score is 5.1, indicating a medium severity level. The attack vector is local (AV:L), meaning the attacker must have local access to the system to exploit this vulnerability. The attack complexity is low (AC:L), and no privileges are required (PR:N), nor is user interaction needed (UI:N). The impact affects confidentiality and integrity to a limited extent but does not affect availability. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability's scope is unchanged, meaning the impact is confined to the vulnerable component without affecting other system components. Since the vulnerability involves local access, it is primarily a risk in environments where unauthorized users can gain local system access, such as shared hosting environments, poorly secured internal networks, or compromised user accounts. The exposure of configuration files could lead to further attacks if sensitive credentials or configuration details are revealed, potentially facilitating privilege escalation or lateral movement within the network.

Detailed information about CVE-2025-52372: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2025-52374: n/aCVE-2025-52374 0 Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-52374 Join the discussion	CVE Database V5	07/21/2025, 00:00:00 UTC Added: 07/21/2025, 16:16:06 UTC
CVE-2025-52373: n/aCVE-2025-52373 0 Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-52373 Join the discussion	CVE Database V5	07/21/2025, 00:00:00 UTC Added: 07/21/2025, 16:16:06 UTC
CVE-2025-52372: n/aCVE-2025-52372 0 An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-52372 Join the discussion	CVE Database V5	07/21/2025, 00:00:00 UTC Added: 07/21/2025, 16:16:06 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional