Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

foreman

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVE-2025-9572 is an authorization bypass vulnerability identified in The Foreman version 1.22.0, specifically affecting its GraphQL API endpoint. Foreman is an open-source lifecycle management tool widely used for provisioning, configuration, and monitoring of physical and virtual servers. The vulnerability stems from improper access control enforcement in the GraphQL API, which allows users with low privileges to retrieve metadata that should be restricted based on their assigned permissions. Unlike the REST API of Foreman, which correctly applies access control filters, the GraphQL endpoint fails to do so, resulting in an authorization flaw. This means that an attacker with legitimate but limited access can query the GraphQL API to obtain sensitive metadata beyond their authorization scope. The flaw does not require user interaction and can be exploited remotely over the network, with only low privileges needed. The vulnerability impacts confidentiality by exposing sensitive information but does not affect data integrity or system availability. The CVSS 3.1 base score is 5.0, reflecting a medium severity level due to the moderate impact and ease of exploitation. No public exploits or active exploitation campaigns have been reported as of the publication date. The issue was reserved in August 2025 and published in February 2026, with Red Hat as the assigner. Since no patch links are provided, users should monitor vendor advisories for updates or implement access restrictions and monitoring as interim mitigations.

Detailed information about CVE-2025-9572: Exposure of Sensitive Information to an Unauthorized Actor in The Foreman Foreman affecting The Foreman Foreman. Get r

CVE-2025-9572: Exposure of Sensitive Information to an Unauthorized Actor in The Foreman Foreman - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-9572: Incorrect Authorization in The Foreman Foreman

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

CVE-2025-10622 is an OS command injection vulnerability identified in the Foreman component of Red Hat Satellite, specifically version 3.12.0. The flaw arises due to improper neutralization of special elements in server-side command whitelisting, allowing an authenticated user with edit_settings permissions to execute arbitrary OS commands. This vulnerability exploits insufficient validation of commands before execution, enabling attackers to escalate privileges and execute commands with the same rights as the Foreman service. The attack vector is network-based, requiring authentication with elevated permissions but no additional user interaction. The vulnerability affects confidentiality, integrity, and availability by potentially allowing attackers to access sensitive data, modify system configurations, or disrupt services. The CVSS v3.1 score is 8.0, reflecting high severity with a complex attack complexity due to required privileges but significant impact. No public exploits are currently known, but the risk remains high given the critical nature of the Foreman service in managing infrastructure. The vulnerability was published on November 5, 2025, and is assigned by Red Hat. The lack of available patches at the time of disclosure necessitates immediate risk mitigation strategies.

Detailed information about CVE-2025-10622: Client-Side Enforcement of Server-Side Security in Red Hat Red Hat Satellite 6.18 for RHEL 9 affecting Red Hat Red Ha

CVE-2025-10622: Client-Side Enforcement of Server-Side Security in Red Hat Red Hat Satellite 6.18 for RHEL 9 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-10622: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in The Foreman Foreman


CVE-2025-9572: Incorrect Authorization in The Foreman ForemanCVE-2025-9572 0 n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2025-9572 Join the discussion	CVE Database V5	02/27/2026, 07:28:44 UTC Added: 02/27/2026, 07:56:10 UTC
CVE-2025-10622: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in The Foreman ForemanCVE-2025-10622 0 A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting. HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve #cve-2025-10622 Join the discussion	CVE Database V5	11/05/2025, 07:32:14 UTC Added: 11/05/2025, 07:51:49 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional