Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

multi-stack-controller

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

CVE-2025-64121 is an authentication bypass vulnerability classified under CWE-288 affecting Nuvation Energy's Multi-Stack Controller (MSC) versions 2.3.8 through before 2.5.1. The vulnerability arises because the MSC allows authentication to be circumvented via an alternate path or communication channel, effectively enabling an attacker to gain unauthorized access without valid credentials or any user interaction. The vulnerability is remotely exploitable over the network (AV:N), requires no privileges (PR:N), and no user interaction (UI:N), making it highly accessible to attackers. The CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H), and the scope is partially changed (S:P), meaning the vulnerability affects resources beyond the initially vulnerable component. The MSC is a critical component in energy management systems, controlling stacks of energy storage or generation units. Unauthorized access could allow attackers to manipulate energy flows, disrupt power delivery, or cause physical damage to infrastructure. No patches are currently linked, and no public exploits are known, but the critical severity score demands urgent attention. The vulnerability was reserved in late 2025 and published in early 2026, indicating recent discovery and disclosure. The MSC's role in energy infrastructure makes this vulnerability a high-value target for threat actors aiming at industrial control systems or critical infrastructure.

Detailed information about CVE-2025-64121: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Nuvation Energy Multi-Stack Controller (MSC) aff

CVE-2025-64121: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Nuvation Energy Multi-Stack Controller (MSC) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-64121: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Nuvation Energy Multi-Stack Controller (MSC)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

CVE-2025-64120 is an OS command injection vulnerability classified under CWE-78, affecting Nuvation Energy's Multi-Stack Controller (MSC) versions from 2.3.8 up to but not including 2.5.1. The vulnerability stems from improper neutralization of special characters in OS commands, allowing attackers to inject and execute arbitrary commands on the underlying operating system. This can be exploited remotely over the network without requiring user interaction, and only low-level privileges are needed, making exploitation relatively straightforward. The MSC is a controller used in energy management systems, particularly for managing stacks of energy storage or generation units. Successful exploitation could lead to full system compromise, enabling attackers to disrupt energy operations, manipulate data, or cause denial of service. The CVSS 4.0 score of 9.4 indicates critical severity, with high impact on confidentiality, integrity, and availability, and a broad scope of affected components. No public exploits are known yet, but the vulnerability's nature and ease of exploitation make it a high priority for patching and mitigation. The vulnerability was reserved in late 2025 and published in early 2026, highlighting its recent discovery and the need for immediate attention.

Detailed information about CVE-2025-64120: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nuvation Energy 

CVE-2025-64120: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nuvation Energy Multi-Stack Controller (MSC) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-64120: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nuvation Energy Multi-Stack Controller (MSC)


CVE-2025-64121: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Nuvation Energy Multi-Stack Controller (MSC)CVE-2025-64121 0 Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1. CriticalVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-64121 #cwe-288 Join the discussion	CVE Database V5	01/02/2026, 21:35:53 UTC Added: 01/02/2026, 21:43:44 UTC
CVE-2025-64120: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nuvation Energy Multi-Stack Controller (MSC)CVE-2025-64120 0 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1. CriticalVulnerabilityGermanyFranceNetherlands+3#cve #cve-2025-64120 #cwe-78 Join the discussion	CVE Database V5	01/02/2026, 21:33:23 UTC Added: 01/02/2026, 21:43:44 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional