Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DWR-M920

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

CVE-2025-15191 identifies a command injection vulnerability in the D-Link DWR-M920 LTE router series, specifically in firmware versions up to 1.1.50. The vulnerability resides in the function sub_4155B4 of the /boafrm/formLtefotaUpgradeFibocom component, where the fota_url parameter is improperly sanitized. This flaw allows an attacker to inject arbitrary commands remotely without requiring authentication or user interaction. The attack vector is network-based, exploiting the router's firmware upgrade mechanism by manipulating the URL parameter used for firmware over-the-air (FOTA) updates. Successful exploitation can lead to arbitrary code execution with the privileges of the affected process, potentially compromising the device's integrity and availability. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, reflecting the ease of exploitation but limited scope of impact. Although no active exploitation has been reported, a public exploit exists, increasing the likelihood of future attacks. The vulnerability affects a wide range of firmware versions (1.1.0 through 1.1.50), indicating a long-standing issue. The lack of authentication and user interaction requirements makes this a significant risk for exposed devices. The router is commonly used in LTE network environments, often in small office/home office (SOHO) or remote connectivity scenarios, making it a critical point of failure if compromised.

Detailed information about CVE-2025-15191: Command Injection in D-Link DWR-M920 affecting D-Link DWR-M920. Get real-time updates, technical details, and mitigat

CVE-2025-15191: Command Injection in D-Link DWR-M920 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-15191: Command Injection in D-Link DWR-M920

dwr-m920

A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited.

CVE-2025-15190 is a stack-based buffer overflow vulnerability identified in the D-Link DWR-M920 router firmware versions 1.1.0 through 1.1.50. The vulnerability resides in the sub_42261C function of the /boafrm/formFilter file, where the ip6addr argument is improperly validated or sanitized, allowing an attacker to overflow the stack buffer. This flaw can be triggered remotely without requiring authentication or user interaction, making it highly exploitable over the network. The overflow can lead to arbitrary code execution, enabling attackers to take full control of the device, disrupt network services, or pivot into internal networks. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:L), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H). Although no confirmed exploits in the wild have been reported, a public exploit has been released, increasing the likelihood of exploitation. The DWR-M920 is a 4G LTE router commonly deployed in small to medium business and residential environments, often used in Europe for broadband connectivity. The vulnerability's remote nature and potential for complete device compromise make it a critical risk for organizations relying on this hardware for network access and security.

Detailed information about CVE-2025-15190: Stack-based Buffer Overflow in D-Link DWR-M920 affecting D-Link DWR-M920. Get real-time updates, technical details, a

CVE-2025-15190: Stack-based Buffer Overflow in D-Link DWR-M920 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-15190: Stack-based Buffer Overflow in D-Link DWR-M920


CVE-2025-15191: Command Injection in D-Link DWR-M920CVE-2025-15191 0 A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-15191 Join the discussion	CVE Database V5	12/29/2025, 14:02:07 UTC Added: 12/30/2025, 22:22:53 UTC
CVE-2025-15190: Stack-based Buffer Overflow in D-Link DWR-M920CVE-2025-15190 0 A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. HighVulnerabilityGermanyFranceItaly+7#cve #cve-2025-15190 Join the discussion	CVE Database V5	12/29/2025, 13:32:08 UTC Added: 12/30/2025, 22:22:53 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional