Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

pdfmake

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

CVE-2026-26801 is a Server-Side Request Forgery (SSRF) vulnerability identified in the pdfmake library, specifically in versions 0.3.0-beta.2 through 0.3.5. The vulnerability is located in the src/URLResolver.js component, which is responsible for resolving URLs when pdfmake processes PDF generation requests. SSRF vulnerabilities allow attackers to trick the server into making HTTP requests to arbitrary URLs, potentially accessing internal resources or sensitive data that would otherwise be inaccessible externally. In this case, the attacker can exploit the lack of URL access restrictions to retrieve sensitive information from internal systems or services reachable by the server. The vulnerability does not require any authentication or user interaction, making it easier to exploit remotely. The fix was introduced in version 0.3.6, which added the setUrlAccessPolicy() method. This method enables server operators to define strict URL access rules, effectively preventing unauthorized SSRF attempts. Additionally, the updated version logs warnings when pdfmake is used server-side without a configured URL access policy, encouraging administrators to enforce security controls. The CVSS v3.1 base score is 7.5 (high), reflecting the vulnerability's network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. No integrity or availability impact is noted. As of now, there are no known exploits in the wild targeting this vulnerability. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).

Detailed information about CVE-2026-26801: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-26801: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-26801: n/a

An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.

CVE-2024-25180 identifies a critical remote code execution (RCE) vulnerability in pdfmake version 0.2.9, a popular JavaScript library used for generating PDF documents. The vulnerability exists in the /pdf endpoint, which processes POST requests. Attackers can craft malicious POST requests that exploit improper input validation or unsafe code execution paths, allowing arbitrary code execution on the server hosting pdfmake. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating that user-supplied input is executed as code without sufficient sanitization or validation. Notably, the /pdf endpoint is not part of the standard pdfmake distribution but is exposed only when a separate test framework is installed alongside pdfmake. This test framework is intended for authorized testing purposes and is not meant for production environments. The vulnerability is disputed because the endpoint's behavior is considered intentional within the test framework context. The CVSS v3.1 base score of 9.8 reflects the vulnerability's high severity, with attack vector Network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). No patches or fixes have been published yet, and no known exploits have been observed in the wild. The risk primarily arises if the test framework is inadvertently exposed to untrusted networks, allowing remote attackers to leverage this endpoint for code execution.

Detailed information about CVE-2024-25180: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-25180: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-25180: n/a


CVE-2026-26801: n/aCVE-2026-26801 0 Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2026-26801 Join the discussion	CVE Database V5	03/10/2026, 00:00:00 UTC Added: 03/10/2026, 18:32:00 UTC
CVE-2024-25180: n/aCVE-2024-25180 0 An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers. CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2024-25180 Join the discussion	CVE Database V5	02/29/2024, 00:00:00 UTC Added: 02/25/2026, 21:45:05 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional