Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

couch-auth

An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.

CVE-2025-70949 identifies a timing side-channel vulnerability in the @perfood/couch-auth package version 0.26.0, a Node.js authentication library commonly used with CouchDB-based applications. The vulnerability stems from observable timing discrepancies during authentication or cryptographic verification processes, where the time taken to respond varies depending on secret data values. Attackers can exploit this by sending numerous carefully timed requests and analyzing response times to infer sensitive information such as password hashes, authentication tokens, or cryptographic keys. This type of side-channel attack bypasses traditional access controls by exploiting implementation details rather than direct software flaws. The vulnerability does not require prior authentication, increasing its risk profile. Although no known exploits are reported in the wild, the lack of a patch or mitigation guidance at present leaves systems exposed. The absence of a CVSS score necessitates severity estimation based on the potential confidentiality breach and ease of exploitation. The flaw affects all deployments using the vulnerable version of @perfood/couch-auth, which may be embedded in various web applications, APIs, and backend services relying on CouchDB authentication. The timing differences likely arise from non-constant-time comparison functions or conditional logic that short-circuits on mismatches, a common pitfall in cryptographic implementations. Without remediation, attackers with network access can perform reconnaissance and credential extraction, leading to further compromise of systems and data.

Detailed information about CVE-2025-70949: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-70949: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-70949: n/a

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

CVE-2025-70948 is a host header injection vulnerability identified in the mailer component of the @perfood/couch-auth package, specifically version 0.26.0. The vulnerability arises because the mailer functionality relies on the HTTP Host header without proper validation or sanitization. An attacker can craft HTTP requests with a spoofed Host header to manipulate the generation or delivery of password reset tokens. By doing so, the attacker can intercept or obtain these tokens, which are intended to be secret and used to reset user passwords securely. With access to these tokens, the attacker can perform account takeover attacks, gaining unauthorized access to user accounts. This vulnerability affects the confidentiality of reset tokens and the integrity of user accounts. Exploitation does not require user interaction but does require the attacker to send specially crafted requests to the vulnerable service. No CVSS score has been assigned yet, and no patches or fixes have been published at the time of disclosure. The vulnerability is classified as a security weakness in input validation and trust boundary enforcement within the authentication system. The lack of known exploits in the wild suggests it is newly discovered, but the potential impact is significant due to the sensitive nature of password reset mechanisms.

Detailed information about CVE-2025-70948: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-70948: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-70948: n/a

A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information

CVE-2024-57177 identifies a host header injection vulnerability in the perfood/couch-auth NPM package, versions up to 0.21.2. The vulnerability arises when the application processes the host header in the email change confirmation request without proper validation or sanitization. By crafting a malicious host header, an attacker can trigger a server-side template injection (SSTI) within the package's template rendering logic. SSTI vulnerabilities allow attackers to inject and execute arbitrary code or commands on the server, or to leak sensitive server-side information. In this case, the SSTI is limited but still enables execution of some commands or data leakage. The vulnerability does not require any privileges or user interaction, making it remotely exploitable over the network. The CVSS 3.1 score of 7.3 reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Although no public exploits are currently known, the vulnerability's nature and ease of exploitation make it a significant threat. The CWE-1336 classification corresponds to improper neutralization of input during template processing, a common root cause for SSTI. The lack of available patches at the time of publication necessitates immediate mitigation efforts by users of the package.

Detailed information about CVE-2024-57177: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2025-70949: n/aCVE-2025-70949 0 An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2025-70949 Join the discussion	CVE Database V5	03/05/2026, 00:00:00 UTC Added: 03/05/2026, 21:16:04 UTC
CVE-2025-70948: n/aCVE-2025-70948 0 A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header. CriticalVulnerabilityUnited StatesGermanyIndia+7#cve #cve-2025-70948 Join the discussion	CVE Database V5	03/05/2026, 00:00:00 UTC Added: 03/05/2026, 21:16:04 UTC
CVE-2024-57177: n/aCVE-2024-57177 0 A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information HighVulnerabilityGermanyUnited KingdomFrance+3#cve #cve-2024-57177 Join the discussion	CVE Database V5	02/10/2025, 00:00:00 UTC Added: 12/17/2025, 16:07:18 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional