Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

jose4j

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVE-2024-29371 is a vulnerability identified in the jose4j Java library, specifically in versions prior to 0.9.6. The flaw arises from the way the library handles JSON Web Encryption (JWE) tokens that are compressed before encryption. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, which when processed by the vulnerable jose4j implementation, causes excessive memory allocation and prolonged processing time during decompression. This leads to a Denial-of-Service (DoS) condition by exhausting server resources, thereby impacting the availability of services relying on this library. The vulnerability does not affect confidentiality or integrity of data, as it does not allow unauthorized data access or modification. It can be exploited remotely without requiring authentication or user interaction, increasing its risk profile. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and a significant impact on availability. The vulnerability is categorized under CWE-1259, which relates to resource exhaustion through decompression bombs or similar techniques. No public exploits have been reported yet, but the nature of the flaw makes it a plausible target for attackers aiming to disrupt services. The lack of a patch link suggests that users should upgrade to jose4j version 0.9.6 or later where the issue is resolved. Organizations using jose4j for handling JWE tokens in authentication, authorization, or secure messaging should prioritize remediation to prevent potential DoS attacks.

Detailed information about CVE-2024-29371: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-29371: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-29371: n/a

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

CVE-2023-51775 is a denial of service vulnerability identified in the jose4j Java library, specifically affecting versions prior to 0.9.4. The flaw arises from the handling of the p2c (PBES2 Count) parameter used in password-based encryption schemes. An attacker can supply an excessively large p2c value, which causes the library to perform an inordinate number of cryptographic iterations, leading to excessive CPU consumption and effectively a denial of service condition. This vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). The attack vector is network-based and requires low privileges, with no user interaction needed, making it relatively easy to exploit in environments where jose4j is used for cryptographic operations. The CVSS v3.1 score is 6.5, reflecting a medium severity due to the impact on availability without affecting confidentiality or integrity. No patches were linked in the provided data, but the fixed version is 0.9.4 or later. No known exploits have been reported in the wild yet, but the vulnerability poses a risk to applications relying on jose4j for secure cryptographic functions, especially those exposed to untrusted inputs.

Detailed information about CVE-2023-51775: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-51775: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-51775: n/a


CVE-2024-29371: n/aCVE-2024-29371 0 In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. HighVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2024-29371 Join the discussion	CVE Database V5	12/17/2025, 00:00:00 UTC Added: 12/17/2025, 16:07:18 UTC
CVE-2023-51775: n/aCVE-2023-51775 0 The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2023-51775 Join the discussion	CVE Database V5	12/25/2023, 00:00:00 UTC Added: 11/03/2025, 22:01:28 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional