Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2025-66908 is a medium severity vulnerability in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) related to improper file type validation in the OCR image upload functionality. The system relies solely on client-supplied Content-Type headers and file extensions without verifying actual file content using magic bytes, allowing attackers to upload arbitrary file types including executables or web shells. This can lead to server-side code execution, stored cross-site scripting (XSS), or information disclosure depending on file processing and serving. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type). No known exploits are currently reported in the wild. The CVSS score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. European organizations using affected Turms AI-Serving versions should prioritize validation improvements and restrict file handling to mitigate risks. Join the discussion | CVE Database V5 | 12/19/2025, 00:00:00 UTC Added: 12/19/2025, 14:55:30 UTC |
0 CVE-2025-66909 is a high-severity denial of service vulnerability in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier). It arises from improper validation of image dimensions and pixel count during decompression in the ExtendedOpenCVImage class, which uses OpenCV's imread() function. An attacker can upload a crafted compressed image that decompresses to consume excessive memory, causing immediate service crashes due to OutOfMemoryError. No authentication or user interaction is required if the OCR service is publicly accessible, enabling remote attackers to repeatedly trigger service outages. This vulnerability affects availability but does not impact confidentiality or integrity. European organizations using this AI-Serving module in publicly accessible OCR services are at risk of denial of service attacks. Mitigation requires implementing strict validation of image size before decompression, rate limiting, and restricting public access. Countries with higher adoption of AI and OCR technologies in critical infrastructure and services, such as Germany, France, and the UK, are most likely to be affected. Join the discussion | CVE Database V5 | 12/19/2025, 00:00:00 UTC Added: 12/19/2025, 14:40:04 UTC |
Showing 1 to 2 of 2 results