Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

qemu

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

CVE-2024-24474 is a vulnerability identified in QEMU, an open-source machine emulator and virtualizer, affecting versions before 8.2.0. The issue arises from an integer underflow in the esp_do_nodma function located in the SCSI emulation code (hw/scsi/esp.c). Specifically, when a Target Initiator (TI) command specifies a non-DMA transfer length that is less than the length of the available FIFO data, the async_len variable underflows. This underflow leads to a buffer overflow condition, as the code attempts to process more data than allocated, resulting in memory corruption. The vulnerability is classified under CWE-191 (Integer Underflow) and CWE-120 (Buffer Overflow), both of which are common and dangerous software weaknesses. Exploitation requires network access (AV:N), low attack complexity (AC:L), and low privileges (PR:L), but does not require user interaction (UI:N). The scope is unchanged (S:U), meaning the vulnerability affects only the vulnerable component. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), indicating potential for full system compromise. No public exploits have been reported yet, but the nature of the flaw suggests that successful exploitation could allow an attacker to execute arbitrary code on the host running QEMU, potentially compromising all guest and host systems. The vulnerability was published on February 20, 2024, with no patches currently linked, indicating that remediation is pending or in progress.

Detailed information about CVE-2024-24474: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-24474: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-24474: n/a

An issue was discovered in QEMU 7.1.0 through 8.2.1.register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.

CVE-2024-26328 is a vulnerability identified in QEMU versions 7.1.0 through 8.2.1 related to the handling of PCI SR-IOV (Single Root I/O Virtualization) virtual functions within the virtualization platform. The root cause lies in the register_vfs function located in the hw/pci/pcie_sriov.c source file, which fails to properly set the NumVFs variable to the expected constant PCI_SRIOV_TOTAL_VF. This incorrect setting leads to improper interaction with the NVMe controller code in hw/nvme/ctrl.c. SR-IOV allows a single physical PCI device to appear as multiple separate virtual devices, improving performance and resource allocation in virtualized environments. The mishandling of NumVFs can cause the NVMe controller to behave unexpectedly, potentially leading to denial of service conditions such as crashes or unresponsiveness of virtualized NVMe devices. The vulnerability requires local attacker privileges with high-level access (PR:H) and does not require user interaction (UI:N). The scope is considered changed (S:C) because the impact affects components beyond the initial vulnerable code, specifically the NVMe controller handling. The CVSS v3.1 base score is 6.0, reflecting a medium severity level, with an attack vector limited to local access and a low attack complexity. Confidentiality and integrity are not impacted, but availability can be significantly affected. No public exploits or patches are currently documented, indicating that the vulnerability is newly disclosed and may not yet be widely exploited. This issue is particularly relevant for organizations running QEMU-based virtualization with PCI SR-IOV enabled NVMe devices, as they may experience service disruptions or instability if exploited.

Detailed information about CVE-2024-26328: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-26328: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-26328: n/a

An issue was discovered in QEMU 7.1.0 through 8.2.1.register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.

CVE-2024-26327 is a vulnerability identified in QEMU versions 7.1.0 through 8.2.1, specifically within the PCIe SR-IOV (Single Root I/O Virtualization) implementation. The issue arises in the register_vfs function located in hw/pci/pcie_sriov.c, where the software mishandles a scenario in which a guest virtual machine writes a NumVFs (number of virtual functions) value exceeding the TotalVFs (total virtual functions) supported. This improper validation leads to a heap-based buffer overflow (CWE-122) in the virtual function implementations. The buffer overflow can cause memory corruption, which in this case impacts the availability of the virtualized environment by potentially crashing or destabilizing the QEMU process hosting the guest VM. The CVSS v3.1 base score is 5.3, reflecting medium severity, with an attack vector of adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and impact limited to availability (A:H) without affecting confidentiality or integrity. No known exploits have been reported in the wild, and no patches are currently linked, indicating that mitigation may require manual intervention or updates from QEMU maintainers. This vulnerability is particularly relevant for environments using PCIe SR-IOV to provide virtualized network or device functions, common in cloud and data center virtualization scenarios.

Detailed information about CVE-2024-26327: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2024-24474: n/aCVE-2024-24474 0 QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. HighVulnerabilityUnited StatesGermanyChina+7#cve #cve-2024-24474 Join the discussion	CVE Database V5	02/20/2024, 00:00:00 UTC Added: 02/25/2026, 21:45:00 UTC
CVE-2024-26328: n/aCVE-2024-26328 0 An issue was discovered in QEMU 7.1.0 through 8.2.1.register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled. MediumVulnerabilityUnited StatesGermanyJapan+7#cve #cve-2024-26328 Join the discussion	CVE Database V5	02/19/2024, 00:00:00 UTC Added: 02/25/2026, 21:45:25 UTC
CVE-2024-26327: n/aCVE-2024-26327 0 An issue was discovered in QEMU 7.1.0 through 8.2.1.register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations. MediumVulnerabilityUnited StatesGermanyJapan+7#cve #cve-2024-26327 Join the discussion	CVE Database V5	02/19/2024, 00:00:00 UTC Added: 02/25/2026, 21:45:25 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional