Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

dcm4chee-arc-light

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

The vulnerability arises from the HL7 listener in dcm4chee-arc-light (version 5.35.1) accepting ADT^A40 patient-merge messages without verifying the identity of the sending application. This lack of authentication (CWE-306) enables a remote attacker to reassign studies and related workflow records between patient identities. The archive's unmerge operation does not reverse these reassignments, leading to potential data integrity and workflow disruption.

CVE-2026-105667 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender. This allows a remote attacker to reassign medical studies and workflow records from one patient to another. The archive's 

CVE-2026-105667: CWE-306 in J4Care dcm4chee-arc-light

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

The vulnerability identified as CVE-2026-101021 affects the MultipartInputStream in J4Care's dcm4chee-arc-light version 5.35.1. The component inefficiently matches boundaries and performs unnecessary buffer copying when processing multipart input. An attacker can craft multipart input to trigger excessive boundary comparisons and repeated copying operations, which can degrade system performance or cause denial of service conditions. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

CVE-2026-101021 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the MultipartInputStream component performs inefficient boundary matching and unnecessary buffer copying. This flaw allows crafted multipart input to cause excessive boundary comparisons and repeated copying, lead

CVE-2026-101021: CWE-407 in J4Care dcm4chee-arc-light

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

The vulnerability identified as CVE-2026-105273 affects the MP4Parser in J4Care's dcm4chee-arc-light version 5.35.1. The parser does not properly validate the sizes of MP4 boxes, allowing a malformed box to cause the parsing process to make no forward progress and repeatedly process the same input. This results in a denial of service impact due to resource exhaustion or application hang. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but a high impact on availability.

CVE-2026-105273 is a high-severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from inadequate validation of MP4 box sizes in the MP4Parser component, which can cause the parser to get stuck processing the same malformed input repeatedly, leading to a denial of serv


CVE-2026-105667: CWE-306 in J4Care dcm4chee-arc-lightCVE-2026-105667 0 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this. HighVulnerability#cve #cve-2026-105667 #cwe-306 Join the discussion	CVE Database V5	10/16/2026, 14:32:22 UTC Added: 10/16/2026, 15:04:09 UTC
CVE-2026-101021: CWE-407 in J4Care dcm4chee-arc-lightCVE-2026-101021 0 MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying. HighVulnerability#cve #cve-2026-101021 #cwe-407 Join the discussion	CVE Database V5	10/16/2026, 14:28:54 UTC Added: 10/16/2026, 14:49:14 UTC
CVE-2026-105273: CWE-835 in J4Care dcm4chee-arc-lightCVE-2026-105273 0 MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input. HighVulnerability#cve #cve-2026-105273 #cwe-835 Join the discussion	CVE Database V5	10/16/2026, 14:21:12 UTC Added: 10/16/2026, 14:49:14 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional