Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

exito

Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.

CVE-2025-41020 is an insecure direct object reference (IDOR) vulnerability classified under CWE-639, affecting Sergestec's Exito version 8.0. The vulnerability exists in the '/admin/ticket_a4.php' endpoint where the 'id' parameter is user-controlled and insufficiently validated. This flaw allows an attacker with limited privileges (PR:L) to bypass authorization controls and access data belonging to other customers by manipulating the 'id' parameter. The vulnerability is remotely exploitable (AV:N) without requiring user interaction (UI:N) or elevated privileges beyond limited access, making it relatively easy to exploit. The CVSS 4.0 vector indicates high impact on confidentiality (VC:H) with no impact on integrity or availability. The absence of authentication bypass or user interaction requirements increases the risk of automated or scripted attacks. No patches or known exploits are currently reported, but the vulnerability's presence in an administrative interface suggests potential for significant data leakage. The root cause is inadequate server-side authorization checks on object references, a common issue in web applications that handle multi-tenant data. Effective mitigation requires validating that the requesting user is authorized to access the requested resource identified by the 'id' parameter. This vulnerability highlights the importance of secure coding practices around access control and parameter validation in web applications.

Detailed information about CVE-2025-41020: CWE-639 Authorization Bypass Through User-Controlled Key in Sergestec Exito affecting Sergestec Exito. Get real-time 

CVE-2025-41020: CWE-639 Authorization Bypass Through User-Controlled Key in Sergestec Exito - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-41020: CWE-639 Authorization Bypass Through User-Controlled Key in Sergestec Exito

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.

CVE-2025-41018 is a critical SQL injection vulnerability identified in Sergestec's Exito version 8.0. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) within the 'cat' parameter of the '/public.php' script. An attacker can exploit this flaw remotely without authentication or user interaction, sending crafted input to manipulate SQL queries executed by the application. This manipulation enables the attacker to perform unauthorized actions on the backend database, including data retrieval, insertion, modification, and deletion. The vulnerability has been assigned a CVSS 4.0 score of 9.3, reflecting its critical severity, with attack vector being network-based, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Despite the absence of known exploits in the wild, the vulnerability's characteristics make it a prime target for attackers seeking to compromise data or disrupt services. Sergestec has not yet released patches for this issue, increasing the urgency for organizations to implement interim mitigations. The vulnerability affects only version 8.0 of Exito, which is a product used in various sectors for database-driven applications. The improper input sanitization in the 'cat' parameter is the root cause, allowing SQL injection attacks that can lead to full database compromise.

Detailed information about CVE-2025-41018: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Sergestec Exito affect

CVE-2025-41018: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Sergestec Exito - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-41018: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Sergestec Exito


CVE-2025-41020: CWE-639 Authorization Bypass Through User-Controlled Key in Sergestec ExitoCVE-2025-41020 0 Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'. HighVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-41020 #cwe-639 Join the discussion	CVE Database V5	10/16/2025, 07:59:06 UTC Added: 10/16/2025, 09:04:08 UTC
CVE-2025-41018: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Sergestec ExitoCVE-2025-41018 0 SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'. CriticalVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-41018 #cwe-89 Join the discussion	CVE Database V5	10/16/2025, 07:56:17 UTC Added: 10/16/2025, 09:04:08 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional