Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

notepad-plus-plus

Notepad++ 8.9.6 - Arbitrary Code Execution

CVE-2026-48778 affects Notepad++ versions up to and including 8.9.6 on Windows 10 and 11. The vulnerability enables arbitrary code execution, allowing an attacker to run code of their choice on the affected system. Exploit code has been published in Python, demonstrating the feasibility of exploitation. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Exploit code for Notepad++ 8.9.6 - Arbitrary Code Execution

Detailed information about Notepad++ 8.9.6 - Arbitrary Code Execution. Get real-time updates, technical details, and mitigation strategies.

Notepad++ 8.9.6 - Arbitrary Code Execution - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

Raw Exploit Code

CVE Details: CVE-2026-48778

CVE-2026-5525 is a stack-based buffer overflow vulnerability in Notepad++ version 8.9.3. It occurs in the file drop handler when a user drags and drops a directory path of exactly 259 characters without a trailing backslash. The application appends a backslash and null terminator without proper bounds checking, causing a stack buffer overflow and application crash. The vulnerability has a medium severity with a CVSS score of 6. No patch or official remediation is currently available, and there are no known exploits in the wild.

This vulnerability in Notepad++ 8.9.3 arises from improper bounds checking in the file drop handler component. Specifically, when a directory path of exactly 259 characters without a trailing backslash is dropped into the application, Notepad++ appends a backslash and null terminator to the path string without verifying buffer capacity. This leads to a stack-based buffer overflow resulting in a crash (STATUS_STACK_BUFFER_OVERRUN). The CVSS 3.1 vector indicates the attack requires local access with low privileges and user interaction, with high impact on confidentiality and integrity but no impact on availability.

Detailed information about CVE-2026-5525: CWE-121: Stack-based Buffer Overflow in Notepad++ Project Notepad++ affecting Notepad++ Project Notepad++. Get real-ti

CVE-2026-5525: CWE-121: Stack-based Buffer Overflow in Notepad++ Project Notepad++ - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-5525: CWE-121: Stack-based Buffer Overflow in Notepad++ Project Notepad++


Notepad++ 8.9.6 - Arbitrary Code ExecutionCVE-2026-48778 0 Notepad++ 8.9.6 - Arbitrary Code Execution HighExploit#remote #exploit #windows 10/11 Join the discussion	Exploit-DB RSS Feed	05/30/2026, 00:00:00 UTC Added: 05/30/2026, 21:38:52 UTC
CVE-2026-5525: CWE-121: Stack-based Buffer Overflow in Notepad++ Project Notepad++CVE-2026-5525 0 CVE-2026-5525 is a stack-based buffer overflow vulnerability in Notepad++ version 8.9.3. It occurs in the file drop handler when a user drags and drops a directory path of exactly 259 characters without a trailing backslash. The application appends a backslash and null terminator without proper bounds checking, causing a stack buffer overflow and application crash. The vulnerability has a medium severity with a CVSS score of 6. No patch or official remediation is currently available, and there are no known exploits in the wild. MediumVulnerability#cve #cve-2026-5525 #cwe-121 Join the discussion	CVE Database V5	04/10/2026, 07:40:59 UTC Added: 04/10/2026, 09:20:45 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional