Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

virtualenv

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

CVE-2026-22702 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in the virtualenv tool, versions prior to 20.36.1. Virtualenv is widely used to create isolated Python environments, commonly employed in development and deployment pipelines. The vulnerability arises due to improper link resolution before file access (CWE-59) and a race condition (CWE-362) during directory creation operations. Specifically, virtualenv performs a check to see if a directory exists and then attempts to create it if absent. An attacker with local access can exploit the time gap between these operations by replacing the directory path with a symbolic link pointing to an attacker-controlled location. This redirection affects virtualenv's app_data and lock file operations, potentially allowing the attacker to manipulate or corrupt files that virtualenv relies on. Although exploitation requires local access and elevated privileges, the impact includes limited confidentiality, integrity, and availability degradation, such as unauthorized file modification or denial of service in the virtual environment setup. The vulnerability has been addressed in virtualenv version 20.36.1 by fixing the TOCTOU race condition and ensuring proper link resolution before file operations. No known exploits are currently reported in the wild.

Detailed information about CVE-2026-22702: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenv affecting pypa virtualenv. 

CVE-2026-22702: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenv - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-22702: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenv

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

CVE-2024-53899 is a command injection vulnerability identified in virtualenv, a widely used tool for creating isolated Python environments. The issue exists in versions prior to 20.26.6 and stems from improper quoting of magic template strings within the activation scripts generated for virtual environments. These scripts are executed when a virtual environment is activated, and due to the flawed string handling, an attacker can inject arbitrary shell commands. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that the root cause is insufficient sanitization or escaping of input used in command execution contexts. Exploitation requires local access but no privileges or user interaction, making it easier for attackers who have gained initial footholds on systems to escalate their control. The CVSS 3.1 score of 8.4 reflects high impact on confidentiality, integrity, and availability, with low attack complexity and no privileges required. Although no public exploits are known yet, the vulnerability poses a serious risk to environments relying on virtualenv for Python development and deployment. This vulnerability is distinct from CVE-2024-9287, which affects different components or versions. The lack of patch links suggests that fixes may be pending or recently released, emphasizing the need for vigilance and timely updates.

Detailed information about CVE-2024-53899: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-53899: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-53899: n/a


CVE-2026-22702: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenvCVE-2026-22702 0 virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1. MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2026-22702 #cwe-59 Join the discussion	CVE Database V5	01/13/2026, 08:53:06 UTC Added: 01/10/2026, 06:24:56 UTC
CVE-2024-53899: n/aCVE-2024-53899 0 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287. HighVulnerabilityUnited StatesGermanyIndia+7#cve #cve-2024-53899 Join the discussion	CVE Database V5	11/24/2024, 00:00:00 UTC Added: 02/25/2026, 21:38:10 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional