Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

hiawatha

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

CVE-2025-57784 identifies a timing attack vulnerability in the authentication mechanism of Hiawatha Web server version 11.7. The root cause is the use of the standard C library function strcmp to compare authentication credentials, which is not constant-time and leaks timing information based on how many characters match before a difference is found. This side channel allows a local attacker to perform an observable timing discrepancy attack (CWE-208) to gradually infer valid authentication tokens or passwords. By repeatedly measuring the time taken to process authentication attempts, the attacker can reconstruct the secret used by the Tomahawk authentication module, thereby gaining unauthorized access to the management client interface. The vulnerability requires local access to the server, as remote exploitation is not indicated. No public exploits have been reported yet, and no CVSS score has been assigned. The management client typically controls critical server configurations, so unauthorized access can lead to full compromise of the web server’s integrity and confidentiality. The absence of a patch link suggests that a fix may not yet be publicly available, increasing the urgency for defensive measures. This vulnerability highlights the importance of using constant-time comparison functions in security-sensitive code to prevent timing side channels.

Detailed information about CVE-2025-57784: CWE-208 Observable Timing Discrepancy in Hiawatha Hiawatha Web server affecting Hiawatha Hiawatha Web server. Get rea

CVE-2025-57784: CWE-208 Observable Timing Discrepancy in Hiawatha Hiawatha Web server - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-57784: CWE-208 Observable Timing Discrepancy in Hiawatha Hiawatha Web server

A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

CVE-2025-57785 is a critical security vulnerability identified in the Hiawatha web server version 11.47, specifically within the XSLT show_index feature. The vulnerability is classified as CWE-415, a double free error, which occurs when the same memory location is freed more than once. This can lead to heap corruption, unpredictable behavior, and potentially arbitrary code execution. The flaw can be triggered by an unauthenticated attacker remotely, without requiring any user interaction, making it highly exploitable. The double free occurs during the processing of XSLT templates used to generate directory indexes, where improper memory management leads to the double free condition. Exploiting this vulnerability could allow attackers to execute arbitrary code with the privileges of the web server process, potentially leading to full system compromise. Although no public exploits have been reported yet, the nature of the vulnerability and its remote, unauthenticated attack vector make it a significant threat. The lack of a CVSS score indicates that the vulnerability is newly disclosed and pending further analysis. The absence of patch links suggests that a fix may not yet be publicly available, increasing the urgency for organizations to monitor vendor updates and apply mitigations promptly. The Hiawatha web server is known for its security-focused design and is used in various environments, including European organizations, which may rely on it for web hosting and application delivery.

Detailed information about CVE-2025-57785: CWE-415 Double Free in Hiawatha Hiawatha Web server affecting Hiawatha Hiawatha Web server. Get real-time updates, te

CVE-2025-57785: CWE-415 Double Free in Hiawatha Hiawatha Web server - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-57785: CWE-415 Double Free in Hiawatha Hiawatha Web server

Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.

CVE-2025-57783 identifies a security vulnerability in Hiawatha Web server version 11.7, specifically an HTTP request smuggling flaw caused by improper parsing of HTTP headers. HTTP request smuggling occurs when an attacker crafts ambiguous HTTP requests that are interpreted differently by front-end and back-end servers or proxies, allowing the attacker to bypass security controls, poison web caches, or gain unauthorized access to restricted resources. In this case, the vulnerability stems from inconsistent interpretation of HTTP requests by the Hiawatha server, leading to the possibility that an attacker can smuggle a malicious request through the server's parsing logic. This vulnerability is classified under CWE-444, which covers inconsistent interpretation of HTTP requests. The flaw allows unauthenticated attackers to access resources that should be restricted, potentially exposing sensitive information or enabling further attacks. Although no public exploits have been reported yet, the nature of HTTP request smuggling makes it a high-risk issue because it can be exploited remotely without authentication. The vulnerability affects only version 11.7 of the Hiawatha Web server, and no official patch or CVSS score has been published as of the date of this report. The lack of a CVSS score requires an expert severity assessment based on the impact and exploitability factors. Given that web servers are critical infrastructure components for hosting web applications and services, this vulnerability poses a significant risk to confidentiality and integrity of data processed by the affected server. Attackers could leverage this flaw to bypass access controls, perform session hijacking, or manipulate web traffic, potentially leading to data breaches or service disruption.

Detailed information about CVE-2025-57783: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Hiawatha Hiawatha Web server affec

CVE-2025-57783: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Hiawatha Hiawatha Web server - Live Threat Intelligence - Threat Radar | OffSeq.com


CVE-2025-57784: CWE-208 Observable Timing Discrepancy in Hiawatha Hiawatha Web serverCVE-2025-57784 0 Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-57784 #cwe-208 Join the discussion	CVE Database V5	01/26/2026, 17:47:19 UTC Added: 01/26/2026, 18:06:06 UTC
CVE-2025-57785: CWE-415 Double Free in Hiawatha Hiawatha Web serverCVE-2025-57785 0 A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-57785 #cwe-415 Join the discussion	CVE Database V5	01/26/2026, 17:46:09 UTC Added: 01/26/2026, 18:06:06 UTC
CVE-2025-57783: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Hiawatha Hiawatha Web serverCVE-2025-57783 0 Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-57783 #cwe-444 Join the discussion	CVE Database V5	01/26/2026, 17:45:36 UTC Added: 01/26/2026, 17:51:07 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional