Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

python

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

CVE-2023-40217 is a vulnerability affecting multiple Python versions before 3.8.18, 3.9.18, 3.10.13, and 3.11.5, specifically impacting server-side TLS implementations that use client certificate authentication. The flaw occurs when a TLS server socket is created and receives data into its buffer but is closed rapidly thereafter. In this scenario, the SSLSocket instance incorrectly detects the socket as 'not connected' and does not initiate the TLS handshake process. Despite this, the buffered data remains accessible and readable from the socket buffer without undergoing authentication. This unauthenticated data can be mistaken for legitimate TLS stream data by the server expecting client certificate authentication, potentially allowing an attacker to inject data that bypasses the expected security checks. The vulnerability is constrained by the requirement that the connection be closed immediately upon SSLSocket initialization, limiting the amount of data that can be injected to the buffer size and preventing direct data exfiltration through this channel. The issue primarily affects Python-based HTTP servers or other services relying on TLS client authentication mechanisms. No CVSS score has been assigned, and no known exploits have been reported in the wild as of the publication date. The root cause lies in the improper handling of socket state transitions and buffered data during TLS handshake initiation in the affected Python versions.

Detailed information about CVE-2023-40217: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-40217: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-40217: n/a

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVE-2023-24329 is a vulnerability identified in the urllib.parse component of Python versions before 3.11.4. The issue arises because the URL parsing logic fails to properly handle URLs that begin with blank characters (such as spaces or tabs). This flaw allows attackers to craft URLs that bypass blocklisting mechanisms designed to prevent access to malicious or unauthorized URLs. Specifically, security controls that rely on string matching or pattern blocking may not recognize URLs starting with whitespace as blocked, enabling attackers to circumvent these controls. The vulnerability is classified under CWE-20 (Improper Input Validation), indicating that the root cause is insufficient validation of input data. The CVSS v3.1 base score is 7.5 (high), reflecting that the vulnerability can be exploited remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and it impacts the integrity of the system by allowing malicious URLs to bypass filters (C:N/I:H/A:N). Although no exploits have been reported in the wild, the vulnerability poses a significant risk to applications that rely on urllib.parse for URL validation, including web frameworks, security gateways, and filtering tools. The issue was publicly disclosed on February 17, 2023, and fixed in Python 3.11.4. Organizations using affected Python versions should prioritize patching to prevent potential exploitation.

Detailed information about CVE-2023-24329: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-24329: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-24329: n/a


CVE-2023-40217: n/aCVE-2023-40217 0 An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) UnknownVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2023-40217 Join the discussion	CVE Database V5	08/25/2023, 00:00:00 UTC Added: 11/03/2025, 22:01:23 UTC
CVE-2023-24329: n/aCVE-2023-24329 0 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. HighVulnerabilityGermanyUnited KingdomFrance+5#cve #cve-2023-24329 Join the discussion	CVE Database V5	02/17/2023, 00:00:00 UTC Added: 11/03/2025, 22:01:15 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional