Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ngrinder

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

CVE-2024-28213 is a critical security vulnerability identified in NAVER's nGrinder, a popular open-source performance testing platform. The issue stems from unsafe deserialization of Java objects received from unauthenticated users. Specifically, versions of nGrinder prior to 3.5.9 accept serialized Java objects without proper validation or sanitization, allowing attackers to craft malicious payloads that, when deserialized, execute arbitrary code on the server hosting nGrinder. This vulnerability is categorized under CWE-502, which highlights risks associated with deserialization of untrusted data. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. Exploiting this flaw could allow remote attackers to gain full control over the affected system, potentially leading to data breaches, system compromise, or disruption of testing environments. Although no active exploits have been reported yet, the nature of the vulnerability and its ease of exploitation make it a high-priority risk. The lack of authentication requirement and the direct exposure to network inputs exacerbate the threat. NAVER has addressed this issue in version 3.5.9, and users are strongly advised to upgrade. In addition to patching, organizations should consider limiting network exposure of nGrinder instances and implementing monitoring to detect anomalous deserialization attempts.

Detailed information about CVE-2024-28213: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder affecting NAVER nGrinder. Get real-time updates, technica

CVE-2024-28213: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-28213: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder

nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.

CVE-2024-28212 is a critical vulnerability identified in NAVER's nGrinder, a popular open-source performance testing platform. The root cause is the use of an outdated version of the SnakeYAML library prior to nGrinder version 3.5.9. SnakeYAML is responsible for parsing YAML data, but older versions are known to be vulnerable to unsafe deserialization attacks. Unsafe deserialization occurs when untrusted input is deserialized without proper validation, allowing attackers to craft malicious YAML payloads that can execute arbitrary code on the target system. This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The CVSS 3.1 base score is 9.8, indicating critical severity, with attack vector Network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Exploiting this flaw allows remote attackers to execute arbitrary code, potentially taking full control of the affected nGrinder server. No known exploits have been reported in the wild yet, but the vulnerability is publicly disclosed and can be weaponized quickly. The lack of authentication or user interaction requirements makes this vulnerability particularly dangerous. The affected versions are all nGrinder releases before 3.5.9, which means organizations running older versions are vulnerable. The vulnerability affects any deployment of nGrinder exposed to untrusted networks, especially those accessible over the internet or large internal networks. NAVER has published the vulnerability details but no direct patch link is provided in the data; however, upgrading to version 3.5.9 or later is the recommended remediation.

Detailed information about CVE-2024-28212: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder affecting NAVER nGrinder. Get real-time updates, technica

CVE-2024-28212: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-28212: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.

CVE-2024-28211 is a critical vulnerability identified in NAVER's nGrinder, a popular open-source performance testing platform. The flaw exists in versions prior to 3.5.9 and involves unsafe deserialization of untrusted data via Java Management Extensions (JMX) and Remote Method Invocation (RMI) protocols. By default, nGrinder allows connections to JMX/RMI servers without sufficient validation, enabling a remote attacker to connect to a malicious RMI registry. This can lead to arbitrary code execution on the host running nGrinder. The root cause is CWE-502, deserialization of untrusted data, which is a common vector for remote code execution in Java applications. The vulnerability requires no authentication or user interaction, making exploitation straightforward over the network. The CVSS v3.1 base score of 9.8 reflects the critical nature of this flaw, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and full impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Although no exploits have been reported in the wild yet, the ease of exploitation and severity make this a high-priority issue for organizations using nGrinder. NAVER has released version 3.5.9 to address this vulnerability, but no direct patch links were provided in the source data.

Detailed information about CVE-2024-28211: CWE-502 Deserialization of Untrusted Data in NAVER nGrinder affecting NAVER nGrinder. Get real-time updates, technica


CVE-2024-28213: CWE-502 Deserialization of Untrusted Data in NAVER nGrinderCVE-2024-28213 0 nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization. CriticalVulnerabilitySouth KoreaUnited StatesJapan+7#cve #cve-2024-28213 #cwe-502 Join the discussion	CVE Database V5	03/07/2024, 04:49:47 UTC Added: 02/25/2026, 21:45:46 UTC
CVE-2024-28212: CWE-502 Deserialization of Untrusted Data in NAVER nGrinderCVE-2024-28212 0 nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. CriticalVulnerabilitySouth KoreaUnited StatesJapan+7#cve #cve-2024-28212 #cwe-502 Join the discussion	CVE Database V5	03/07/2024, 04:49:37 UTC Added: 02/25/2026, 21:45:46 UTC
CVE-2024-28211: CWE-502 Deserialization of Untrusted Data in NAVER nGrinderCVE-2024-28211 0 nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker. CriticalVulnerabilitySouth KoreaUnited StatesJapan+7#cve #cve-2024-28211 #cwe-502 Join the discussion	CVE Database V5	03/07/2024, 04:49:21 UTC Added: 02/25/2026, 21:45:46 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional