Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

builder

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.

CVE-2025-67230 is a security vulnerability identified in ToDesktop Builder version 0.33.0, a tool used to create desktop applications from web technologies. The vulnerability arises from improper permission handling in the Custom URL Scheme handler. Specifically, the handler allows code executing in the renderer context—which is the environment where web content runs—to invoke external protocol handlers without adequate validation. This means that an attacker who has already gained access to the renderer process can exploit this flaw to trigger external applications or protocols on the host system. Such external protocol invocations could lead to unintended actions outside the sandboxed environment, including launching malicious applications, leaking sensitive information, or escalating privileges. The vulnerability does not require user interaction but does require that the attacker has renderer-level access, which typically implies a prior compromise or malicious content execution. No CVSS score has been assigned yet, and no public exploits have been reported. The lack of patch links suggests that fixes are not yet publicly available. This vulnerability highlights the risks associated with insufficient validation of custom URL schemes in desktop applications built on web technologies, which can be abused to bypass security boundaries between web content and the host operating system.

Detailed information about CVE-2025-67230: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-67230: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67230: n/a

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

The vulnerability CVE-2024-7387 affects the openshift/builder component in Red Hat OpenShift Container Platform. It allows command injection through path traversal by manipulating the spec.source.secrets.secret.destinationDir attribute in BuildConfig when using the Docker build strategy. This enables an attacker with code execution in a privileged build container to escalate privileges on the underlying node. Red Hat has issued security advisories RHSA-2024:3718 and RHSA-2024:6685 detailing fixes in OpenShift Container Platform 4.17.0 and 4.15.33 respectively. The advisories include updated container images and instructions for upgrading clusters to mitigate the vulnerability.

Detailed information about CVE-2024-7387: Execution with Unnecessary Privileges. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-7387: Execution with Unnecessary Privileges - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-7387: Execution with Unnecessary Privileges


CVE-2025-67230: n/aCVE-2025-67230 0 Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation. HighVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-67230 Join the discussion	CVE Database V5	01/23/2026, 00:00:00 UTC Added: 01/23/2026, 16:35:56 UTC
CVE-2024-7387: Execution with Unnecessary PrivilegesCVE-2024-7387 0 A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container. CriticalVulnerability#cve #cve-2024-7387 Join the discussion	CVE Database V5	09/16/2024, 23:58:35 UTC Added: 11/11/2025, 15:31:11 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional