Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

download-station

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later

CVE-2025-58463 is a security vulnerability classified under CWE-23 (Relative Path Traversal) affecting QNAP Systems Inc.'s Download Station software, specifically versions 5.10.x prior to 5.10.0.305 and 5.10.0.304. This vulnerability allows an attacker who has already obtained administrator-level access to the Download Station to exploit the relative path traversal flaw to read files outside the intended directory scope. By manipulating file paths, the attacker can access arbitrary files on the underlying system, potentially exposing sensitive configuration files, credentials, or system data. The vulnerability does not allow privilege escalation or remote code execution but compromises confidentiality by unauthorized file disclosure. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:H means high privileges required), no user interaction (UI:N), and no impact on confidentiality, integrity, or availability (VC:N, VI:N, VA:N), but scope is changed (SC:H) and security impact is high (SI:H). However, the overall CVSS score is low (2.3) primarily because exploitation requires prior administrative access, limiting the attack surface. The vendor released patches in September 2025 to address this issue. No known exploits have been reported in the wild, suggesting limited active exploitation. This vulnerability highlights the importance of securing administrative credentials and promptly applying vendor patches to prevent unauthorized file access via path traversal attacks.

Detailed information about CVE-2025-58463: CWE-23 in QNAP Systems Inc. Download Station affecting QNAP Systems Inc. Download Station. Get real-time updates, tec

CVE-2025-58463: CWE-23 in QNAP Systems Inc. Download Station - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-58463: CWE-23 in QNAP Systems Inc. Download Station

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later

CVE-2025-58465 is classified as a CWE-79 cross-site scripting vulnerability found in QNAP Systems Inc.'s Download Station, a network-attached storage (NAS) application used for managing downloads. The vulnerability allows an attacker who has already obtained a user account to inject malicious scripts into the application interface. This can lead to bypassing security mechanisms or unauthorized reading of application data. The attack vector is network-based, requiring no physical access, but does require the attacker to have valid user credentials and to trick a user into interacting with the malicious payload (user interaction required). The vulnerability affects versions 5.10.x prior to 5.10.0.304/305, with patches released in September 2025. The CVSS 4.0 vector indicates low attack complexity, no privileges required beyond a user account, and no impact on confidentiality, integrity, or availability beyond the scope of the user's session. No known active exploits have been reported, suggesting limited current threat activity. The vulnerability's presence in a widely used NAS application could allow attackers to leverage XSS for session hijacking, phishing, or further lateral movement within an organization's network if exploited.

Detailed information about CVE-2025-58465: CWE-79 in QNAP Systems Inc. Download Station affecting QNAP Systems Inc. Download Station. Get real-time updates, tec

CVE-2025-58465: CWE-79 in QNAP Systems Inc. Download Station - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-58465: CWE-79 in QNAP Systems Inc. Download Station


CVE-2025-58463: CWE-23 in QNAP Systems Inc. Download StationCVE-2025-58463 0 A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later LowVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-58463 #cwe-23 Join the discussion	CVE Database V5	11/07/2025, 15:10:42 UTC Added: 11/07/2025, 15:26:53 UTC
CVE-2025-58465: CWE-79 in QNAP Systems Inc. Download StationCVE-2025-58465 0 A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later LowVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-58465 #cwe-79 Join the discussion	CVE Database V5	11/07/2025, 15:09:31 UTC Added: 11/07/2025, 15:26:54 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional