Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

SAP-Web-Dispatcher

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

CVE-2025-42878 is a vulnerability classified under CWE-1244, which involves internal assets being exposed to unsafe debug access levels or states. Specifically, SAP Web Dispatcher and Internet Communication Manager (ICM) components may inadvertently expose internal testing or diagnostic interfaces that are not meant for production use. These interfaces, if enabled, allow unauthenticated attackers to access sensitive diagnostic data, send specially crafted requests that could manipulate the service, or cause denial-of-service conditions. The vulnerability affects a broad range of SAP versions, including KRNL64NUC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, and others. The CVSS 3.1 score is 8.2, reflecting high severity with network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), and requiring user interaction (UI:R). The scope is changed (S:C), meaning exploitation can affect resources beyond the vulnerable component. The impact on confidentiality and availability is high, while integrity impact is low. No patches or exploits are currently publicly available, but the presence of these debug interfaces in production environments represents a significant security risk. Organizations running affected SAP components should audit their configurations to ensure debug interfaces are disabled and monitor for unusual diagnostic access attempts.

Detailed information about CVE-2025-42878: CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State in SAP_SE SAP Web Dispatcher and Internet Comm

CVE-2025-42878: CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State in SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-42878: CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State in SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)

Internet-Communication-Manager

SAP-Content-Server

SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confidentiality or integrity of the application.

CVE-2025-42877 is an out-of-bounds write vulnerability classified under CWE-787, affecting SAP SE's Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server components. The vulnerability stems from logical errors in the handling of certain requests that cause memory corruption. This memory corruption can be exploited by an unauthenticated attacker remotely, without any user interaction, to cause a denial of service (DoS) by crashing or destabilizing the affected SAP services. The affected versions include multiple SAP kernel and application service versions, notably KRNL64UC 7.53, WEBDISP 7.53, 7.54, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, and KERNEL 7.53. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impact limited to availability (A:H) without affecting confidentiality or integrity. No patches were linked at the time of reporting, and no known exploits have been observed in the wild. The vulnerability could be leveraged to disrupt SAP services critical for enterprise operations, potentially causing downtime and operational losses. SAP Web Dispatcher and ICM are often deployed as front-end components managing communication and load balancing, while SAP Content Server handles document storage, making their availability crucial for business continuity.

Detailed information about CVE-2025-42877: CWE-787: Out-of-bounds Write in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server affe

CVE-2025-42877: CWE-787: Out-of-bounds Write in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-42877: CWE-787: Out-of-bounds Write in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server


CVE-2025-42878: CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State in SAP_SE SAP Web Dispatcher and Internet Communication Manager (ICM)CVE-2025-42878 0 SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application. HighVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-42878 #cwe-1244 Join the discussion	CVE Database V5	12/09/2025, 02:14:59 UTC Added: 12/09/2025, 02:33:45 UTC
CVE-2025-42877: CWE-787: Out-of-bounds Write in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content ServerCVE-2025-42877 0 SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confidentiality or integrity of the application. HighVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-42877 #cwe-787 Join the discussion	CVE Database V5	12/09/2025, 02:14:51 UTC Added: 12/09/2025, 02:33:45 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional