Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

tpm2-tools

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

CVE-2024-29039 affects the tpm2-tools suite, which provides command-line utilities for interacting with TPM 2.0 hardware modules used for platform integrity and security functions. The vulnerability stems from improper validation of the TPML_PCR_SELECTION structure in the PCR input file used by the tpm2_checkquote command. An attacker can craft a malicious PCR selection input that causes the tool to incorrectly associate digest values with PCR slots and banks. This manipulation leads to a false representation of the TPM's state, potentially allowing attackers to bypass integrity checks or present a compromised system as trustworthy. The root cause is a reliance on untrusted input data in a critical security decision, categorized under CWE-807. Exploitation is remote (network vector) but requires high attack complexity, no privileges, and no user interaction. The vulnerability impacts confidentiality, integrity, and availability by undermining the trustworthiness of TPM attestation results, which are foundational for secure boot, measured boot, and other security mechanisms. The flaw has been addressed in tpm2-tools version 5.7, which properly validates PCR selection inputs to prevent manipulation.

Detailed information about CVE-2024-29039: CWE-807: Reliance on Untrusted Inputs in a Security Decision in tpm2-software tpm2-tools affecting tpm2-software tpm2

CVE-2024-29039: CWE-807: Reliance on Untrusted Inputs in a Security Decision in tpm2-software tpm2-tools - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-29039: CWE-807: Reliance on Untrusted Inputs in a Security Decision in tpm2-software tpm2-tools

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

CVE-2024-29038 is a vulnerability classified under CWE-1283 (Mutable Attestation or Measurement Reporting Data) and CWE-1390 affecting the tpm2-tools software suite, which provides command-line utilities to interact with TPM 2.0 hardware modules. TPM (Trusted Platform Module) is widely used to provide hardware-based security functions, including platform integrity attestation via cryptographic quotes. The vulnerability allows a malicious actor with local access to craft arbitrary quote data that bypasses detection by the tpm2 checkquote utility, which is designed to verify the authenticity and integrity of TPM quotes. This means that an attacker can present falsified attestation data, potentially misleading systems or administrators relying on TPM quotes for security decisions such as secure boot validation, measured boot, or remote attestation. The flaw affects all versions of tpm2-tools starting from 4.1-rc0 up to but excluding 5.7, where the issue has been fixed. The CVSS v3.1 base score is 4.3 (medium severity), reflecting that exploitation requires local access but no privileges or user interaction, and the impact is limited to confidentiality (partial loss of trust in attestation data) without affecting integrity or availability of the system directly. No known exploits have been reported in the wild as of the publication date. The vulnerability highlights the importance of ensuring that TPM quote verification tools themselves are secure and trustworthy, as they form a critical part of the chain of trust in platform security.

Detailed information about CVE-2024-29038: CWE-1283: Mutable Attestation or Measurement Reporting Data in tpm2-software tpm2-tools affecting tpm2-software tpm2-

CVE-2024-29038: CWE-1283: Mutable Attestation or Measurement Reporting Data in tpm2-software tpm2-tools - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-29038: CWE-1283: Mutable Attestation or Measurement Reporting Data in tpm2-software tpm2-tools


CVE-2024-29039: CWE-807: Reliance on Untrusted Inputs in a Security Decision in tpm2-software tpm2-toolsCVE-2024-29039 0 tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7. CriticalVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2024-29039 #cwe-807 Join the discussion	CVE Database V5	06/28/2024, 15:48:25 UTC Added: 11/04/2025, 17:43:40 UTC
CVE-2024-29038: CWE-1283: Mutable Attestation or Measurement Reporting Data in tpm2-software tpm2-toolsCVE-2024-29038 0 tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2024-29038 #cwe-1283 Join the discussion	CVE Database V5	06/28/2024, 13:44:07 UTC Added: 11/04/2025, 17:44:09 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional