Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

pgbouncer

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

CVE-2025-2291 is a vulnerability identified in PgBouncer, a popular lightweight connection pooler for PostgreSQL databases. The issue arises because PgBouncer's authentication query (auth_query) does not consider the PostgreSQL password's VALID UNTIL attribute, which defines the expiration date of a user's password. As a result, PgBouncer allows authentication using passwords that have technically expired according to PostgreSQL's policy. This bypass undermines the security controls intended to enforce password expiration, potentially allowing unauthorized access if an attacker obtains an expired password. The vulnerability is exploitable remotely without requiring any privileges or user interaction, increasing its risk profile. The CVSS v3.1 score of 8.1 reflects the high impact on confidentiality, integrity, and availability, as an attacker gaining access could manipulate or exfiltrate sensitive data, disrupt services, or escalate privileges within the database environment. Although no exploits are currently known in the wild, the flaw's nature makes it a significant threat to organizations relying on PgBouncer for database connection management. The vulnerability affects all versions of PgBouncer prior to the fix, and no patch links are currently provided, indicating that remediation may require monitoring vendor updates or applying workarounds.

Detailed information about CVE-2025-2291: Use of a Key Past its Expiration Date in PgBouncer affecting null PgBouncer. Get real-time updates, technical details,

CVE-2025-2291: Use of a Key Past its Expiration Date in PgBouncer - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-2291: Use of a Key Past its Expiration Date in PgBouncer

Threats Tagged 'cve-2025-2291'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-2291'

Lead Pen Test Professional