Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

zeptoclaw

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.

CVE-2026-32232 is a path traversal vulnerability classified under CWE-22 and CWE-62 affecting ZeptoClaw, a personal AI assistant by qhkm. The vulnerability exists in versions prior to 0.7.6 due to improper limitation of pathname inputs, allowing attackers to exploit dangling symlink component bypasses, TOCTOU race conditions between validation and use of file paths, and hardlink alias bypasses. These flaws enable an attacker to manipulate file system references to access or modify files outside the intended restricted directories. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 base score of 8.8 reflects the vulnerability's high impact on confidentiality and integrity, with no privileges or user interaction needed, and low attack complexity. The flaw could allow attackers to read sensitive configuration files, modify critical data, or execute unauthorized actions by leveraging the AI assistant's file handling mechanisms. The issue was addressed in ZeptoClaw version 0.7.6, which implements stricter pathname validation and mitigations against symlink and hardlink bypass techniques. No public exploits have been reported yet, but the vulnerability poses a significant risk to users of affected versions, especially in environments where ZeptoClaw has access to sensitive data or system files.

Detailed information about CVE-2026-32232: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in qhkm zeptoclaw affecting qh

CVE-2026-32232: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in qhkm zeptoclaw - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-32232: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in qhkm zeptoclaw

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.

CVE-2026-32231 is a vulnerability categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-345 (Insufficient Verification of Data Authenticity) affecting the ZeptoClaw personal AI assistant software by qhkm. Prior to version 0.7.6, the generic webhook channel in ZeptoClaw trusts identity fields such as 'sender' and 'chat_id' provided in the request body without enforcing authentication, as the authentication mechanism is optional and defaults to disabled (auth_token: None). This design flaw allows an attacker who can send HTTP POST requests to the /webhook endpoint to spoof allowlisted sender identities and arbitrarily select chat_id values. Consequently, the attacker can perform high-risk message spoofing, impersonating trusted users or systems, and potentially abuse session or chat routing via IDOR-style attacks, redirecting or intercepting messages intended for other users. The vulnerability has a CVSS v3.1 base score of 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a significant impact on integrity with limited confidentiality impact and no availability impact. Although no exploits have been observed in the wild, the flaw poses a serious risk to the integrity of communications and user sessions within ZeptoClaw deployments. The issue was addressed and fixed in version 0.7.6 by enforcing proper authentication and validation of webhook requests. The vulnerability was publicly disclosed on March 12, 2026.

Detailed information about CVE-2026-32231: CWE-306: Missing Authentication for Critical Function in qhkm zeptoclaw affecting qhkm zeptoclaw. Get real-time updat

CVE-2026-32231: CWE-306: Missing Authentication for Critical Function in qhkm zeptoclaw - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-32231: CWE-306: Missing Authentication for Critical Function in qhkm zeptoclaw


CVE-2026-32232: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in qhkm zeptoclawCVE-2026-32232 0 ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2026-32232 #cwe-22 Join the discussion	CVE Database V5	03/12/2026, 18:24:35 UTC Added: 03/12/2026, 18:47:41 UTC
CVE-2026-32231: CWE-306: Missing Authentication for Critical Function in qhkm zeptoclawCVE-2026-32231 0 ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2026-32231 #cwe-306 Join the discussion	CVE Database V5	03/12/2026, 18:22:48 UTC Added: 03/12/2026, 18:47:41 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional