Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

CVE-2026-48779 affects the ws WebSocket client and server library for Node.js. The vulnerability arises from the ability of a remote attacker to send a large number of exceptionally small WebSocket fragments and data chunks. This forces the affected system to allocate and maintain structural wrappers that consume significantly more memory than the documented message-size limit, resulting in process termination due to out-of-memory conditions. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-770, and CWE-1050. The vulnerability affects multiple version ranges: >=1.1.0 <5.2.5, >=6.0.0 <6.2.4, >=7.0.0 <7.5.11, and >=8.0.0 <8.21.0. Fixes have been released in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. Red Hat's advisory confirms the impact and notes that no suitable mitigation other than upgrading is currently available.

Detailed information about CVE-2026-48779: CWE-400: Uncontrolled Resource Consumption in websockets ws affecting websockets ws. Get real-time updates, technical

CVE-2026-48779: CWE-400: Uncontrolled Resource Consumption in websockets ws - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-48779: CWE-400: Uncontrolled Resource Consumption in websockets ws

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

CVE-2026-45736 is a vulnerability in the ws WebSocket client and server library for Node.js. Specifically, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can result in sensitive information leakage from uninitialized memory areas. The issue is tracked under CWE-908 (Use of Uninitialized Resource) and CWE-824 (Access of Uninitialized Pointer). The vulnerability affects all versions prior to 8.20.1 and has been fixed in 8.20.1. The CVSS v3 base score is 7.5 (High) according to Red Hat's assessment, indicating a network attack vector with low complexity and no required privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported. Red Hat has released advisories and errata addressing this vulnerability.

Detailed information about CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets ws affecting websockets ws. Get real-time updates, technical det

CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets ws - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets ws


CVE-2026-48779: CWE-400: Uncontrolled Resource Consumption in websockets wsCVE-2026-48779 0 ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. HighVulnerability#cve #cve-2026-48779 #cwe-400 Join the discussion	CVE Database V5	06/16/2026, 21:26:22 UTC Added: 06/16/2026, 22:01:09 UTC
CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets wsCVE-2026-45736 0 ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1. MediumVulnerability#cve #cve-2026-45736 #cwe-908 Join the discussion	CVE Database V5	05/15/2026, 14:53:57 UTC Added: 05/15/2026, 15:21:40 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional