Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Verysync

A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-14198 is a medium-severity information disclosure vulnerability affecting Verysync 微力同步 version 2.21.3. The vulnerability resides in an unspecified function within the Web Administration Module, specifically the /safebrowsing/clientreport/download endpoint, which accepts a 'key' parameter (demonstrated with 'dummytoken'). By manipulating requests to this endpoint remotely, an attacker can cause the system to leak sensitive information. The vulnerability requires no authentication, user interaction, or privileges, making it remotely exploitable over the network. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) indicates low complexity and no required privileges or user interaction, with partial confidentiality impact but no integrity or availability impact. Although the vendor was notified early, they have not responded or issued a patch, and exploit code is publicly available, increasing the risk of exploitation. The exact nature of the leaked information is unspecified, but given the module's role in web administration and safebrowsing reporting, it could include sensitive configuration or usage data. No known active exploitation has been reported yet, but the public availability of exploits elevates the threat level. Organizations using Verysync 2.21.3 should consider this vulnerability a significant risk to confidentiality and implement compensating controls until a patch is released.

Detailed information about CVE-2025-14198: Information Disclosure. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-14198: Information Disclosure - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-14198: Information Disclosure

A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-14197 is an information disclosure vulnerability identified in Verysync, a file synchronization and web administration software, affecting versions 2.21.0 through 2.21.3. The vulnerability resides in an unspecified function within the Web Administration Module, specifically the REST API endpoint /rest/f/api/resources/f96956469e7be39d. This endpoint can be manipulated remotely by an unauthenticated attacker to disclose sensitive information. The exact nature of the disclosed information is not detailed, but such leaks typically include configuration data, user information, or system details that could facilitate further attacks. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with attack vector network (remote), low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. The vendor was notified early but has not responded or provided a patch, and no known exploits have been observed in the wild yet. The public disclosure of the exploit increases the risk of exploitation, especially in environments where Verysync is exposed to untrusted networks. The lack of authentication and user interaction requirements makes this vulnerability easier to exploit compared to those requiring credentials or user actions. The vulnerability does not affect integrity or availability, limiting its impact to confidentiality breaches. The Web Administration Module is a critical component, and exposure of sensitive data could lead to further compromise if leveraged by attackers.

Detailed information about CVE-2025-14197: Information Disclosure. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-14197: Information Disclosure - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-14197: Information Disclosure


CVE-2025-14198: Information DisclosureCVE-2025-14198 0 A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-14198 Join the discussion	CVE Database V5	12/07/2025, 16:32:06 UTC Added: 12/07/2025, 16:39:13 UTC
CVE-2025-14197: Information DisclosureCVE-2025-14197 0 A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-14197 Join the discussion	CVE Database V5	12/07/2025, 16:02:05 UTC Added: 12/07/2025, 16:24:28 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional