Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
DB-GPT versions up to 0.8.2 have a critical vulnerability allowing unauthenticated remote code execution via the /api/v1/chat/react-agent endpoint. This endpoint uses a mock authentication function that grants admin privileges to all callers, enabling attackers to execute arbitrary Python or bash commands as root within the webserver container and access the bundled database with default credentials. Join the discussion | CVE Database V5 | 10/20/2026, 00:46:11 UTC Added: 10/20/2026, 01:19:19 UTC |
A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Join the discussion | CVE Database V5 | 03/20/2026, 20:02:14 UTC Added: 03/20/2026, 20:09:24 UTC |
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Python's `/site-packages/` directory. Join the discussion | CVE Database V5 | 03/20/2025, 10:09:18 UTC Added: 10/15/2025, 13:01:23 UTC |
Showing 1 to 3 of 3 results