Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

xormon-ng

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

CVE-2025-54765 is a vulnerability identified in Xorux's XorMon-NG appliance version 1.8, classified under CWE-648 (Incorrect Use of Privileged APIs). The issue stems from an API endpoint designed to be accessible only by web application administrators but is inadvertently accessible to lower-privileged read-only users. This endpoint allows importing the appliance configuration, which can be exploited by an attacker to alter the device’s configuration, including granting themselves administrative privileges. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The CVSS score of 5.3 reflects a medium severity primarily due to the limited impact on confidentiality and no direct impact on integrity or availability, but the potential for privilege escalation is significant. No patches or known exploits are currently available, highlighting the need for proactive mitigation. The root cause is improper access control on privileged API endpoints, which is a common security oversight in web applications managing critical infrastructure. Attackers leveraging this vulnerability could gain full control over the appliance, potentially disrupting monitoring capabilities or using the device as a foothold for further network compromise.

Detailed information about CVE-2025-54765: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG affecting Xorux XorMon-NG. Get real-time updates, techni

CVE-2025-54765: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-54765: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

CVE-2025-54766 identifies a security vulnerability in Xorux's XorMon-NG appliance version 1.8, categorized under CWE-648, which involves the incorrect use of privileged APIs. Specifically, an API endpoint designed exclusively for web application administrators is improperly protected and remains accessible to users with lower-level read-only privileges. This endpoint enables the export of the appliance's configuration data, which may contain sensitive information such as system settings, network configurations, credentials, or other operational details. The vulnerability does not require authentication (PR:N) or user interaction (UI:N) and can be exploited remotely over the network (AV:N) with low attack complexity (AC:L). The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score is 5.3, indicating a medium severity primarily due to the confidentiality impact (C:L) without affecting integrity (I:N) or availability (A:N). No patches or known exploits are currently available, but the exposure of configuration data could facilitate further attacks or reconnaissance by adversaries. The root cause is the failure to properly restrict access to privileged API endpoints, a common security design flaw that can lead to unauthorized information disclosure.

Detailed information about CVE-2025-54766: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG affecting Xorux XorMon-NG. Get real-time updates, techni

CVE-2025-54766: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-54766: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NG


CVE-2025-54765: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NGCVE-2025-54765 0 An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-54765 #cwe-648 Join the discussion	CVE Database V5	07/28/2025, 23:25:12 UTC Added: 07/28/2025, 23:47:39 UTC
CVE-2025-54766: CWE-648: Incorrect Use of Privileged APIs in Xorux XorMon-NGCVE-2025-54766 0 An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-54766 #cwe-648 Join the discussion	CVE Database V5	07/28/2025, 23:16:13 UTC Added: 07/28/2025, 23:32:39 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional