Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

tim-bpm-suite

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.

CVE-2025-67280 identifies multiple Hibernate Query Language (HQL) injection vulnerabilities in the TIM BPM Suite and TIM FLOW software products up to version 9.1.2. HQL injection is a type of injection attack where an attacker manipulates the HQL queries used by the application to interact with the database, allowing unauthorized access or data extraction. In this case, the vulnerabilities enable a low privileged user to craft malicious HQL queries that bypass normal access controls, resulting in the extraction of other users' passwords and sensitive data. The injection points likely exist due to insufficient input validation or improper parameterization of HQL queries within the application code. Since the attacker only requires low privilege access, the attack surface is broad, and exploitation can lead to significant breaches of confidentiality and integrity. No public exploits have been reported yet, and no official patches or mitigations have been linked, indicating a need for urgent attention from vendors and users. The absence of a CVSS score suggests the vulnerability is newly published and under evaluation. The impact is severe because passwords and sensitive data exposure can lead to further compromise, lateral movement, and data breaches within organizations using these BPM tools. The vulnerabilities affect business process management environments, which often contain critical operational data and workflows, increasing the risk to enterprise operations.

Detailed information about CVE-2025-67280: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-67280: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67280: n/a

An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format

The vulnerability identified as CVE-2025-67279 affects TIM Solution GmbH's TIM BPM Suite and TIM FLOW products before version 9.1.2. The core issue is the use of the MD5 hashing algorithm for storing password hashes within the application. MD5 is widely recognized as cryptographically broken and unsuitable for password hashing due to its susceptibility to collision attacks and rapid brute-force cracking using modern hardware. An attacker who gains access to these stored hashes can perform offline attacks to recover plaintext passwords or equivalent credentials. Once credentials are compromised, the attacker can escalate privileges within the system, potentially gaining administrative access. The vulnerability is remotely exploitable, implying that an attacker does not need physical access or prior authentication to leverage this weakness, although the exact attack vector is not detailed. No CVSS score has been assigned yet, and no known exploits have been observed in the wild, but the risk remains significant given the nature of the weakness. The vulnerability affects the confidentiality and integrity of user credentials and the availability of the system if an attacker uses escalated privileges to disrupt services. The vendor has addressed this issue in version 9.1.2 by presumably replacing MD5 with a stronger hashing algorithm and improving credential storage security.

Detailed information about CVE-2025-67279: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-67279: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67279: n/a

tim-flow

An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request

CVE-2025-67278 is a remote privilege escalation vulnerability affecting TIM Solution GmbH's TIM BPM Suite and TIM FLOW products prior to version 9.1.2. The vulnerability arises from improper handling of crafted HTTP requests, which allows an attacker to escalate their privileges remotely without prior authentication. Although the exact technical mechanism is not detailed, the nature of the flaw suggests a flaw in access control or input validation within the HTTP request processing components of the affected software. TIM BPM Suite and TIM FLOW are business process management and workflow automation platforms widely used in enterprise environments to orchestrate and manage complex business processes. The vulnerability's exploitation could allow attackers to gain elevated privileges, potentially leading to unauthorized access to sensitive business workflows, data manipulation, or disruption of critical business processes. No CVSS score has been assigned yet, and no known exploits have been reported in the wild, indicating the vulnerability is newly disclosed. The lack of patch links suggests that a fix may be forthcoming or pending release. The vulnerability's remote nature and lack of authentication requirements increase its risk profile, as attackers can exploit it over the network without needing valid credentials. This makes it a significant threat to organizations relying on these products for critical business operations.

Detailed information about CVE-2025-67278: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2025-67280: n/aCVE-2025-67280 0 In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-67280 Join the discussion	CVE Database V5	01/09/2026, 00:00:00 UTC Added: 01/09/2026, 15:54:57 UTC
CVE-2025-67279: n/aCVE-2025-67279 0 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2025-67279 Join the discussion	CVE Database V5	01/09/2026, 00:00:00 UTC Added: 01/09/2026, 15:54:57 UTC
CVE-2025-67278: n/aCVE-2025-67278 0 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request MediumVulnerabilityGermanyFranceItaly+4#cve #cve-2025-67278 Join the discussion	CVE Database V5	01/09/2026, 00:00:00 UTC Added: 01/09/2026, 15:54:57 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional