Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.

CVE-2025-58431 is a medium-severity vulnerability identified in IceWhaleTech's ZimaOS, an operating system forked from CasaOS designed for Zima devices and x86-64 systems with UEFI. The vulnerability exists in versions 1.4.1 and earlier and involves an endpoint (/v2_1/files/file/download) that allows any user with access to localhost to read arbitrary files on the system. Critically, these file reads are executed with root privileges, meaning that the process handling the request runs with full administrative rights. This vulnerability is classified under CWE-250, which refers to execution with unnecessary privileges, indicating that the system grants more privileges than necessary for the operation. The CVSS 4.0 base score is 4.8, reflecting a medium severity level, with the vector indicating local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and no impact on confidentiality, integrity, or availability (VC:N/VI:N/VA:N), but with a high scope change (SC:H). The vulnerability does not require authentication or user interaction, but access is limited to localhost, meaning an attacker must have some form of local access or be able to execute code locally to exploit it. No known exploits are currently reported in the wild, and no patches have been linked yet. The root cause is the unnecessary execution of file read operations with root privileges, which could allow an attacker with local access to read sensitive files that should otherwise be protected. This could lead to information disclosure or facilitate further attacks if sensitive configuration or credential files are accessed.

Detailed information about CVE-2025-58431: CWE-250: Execution with Unnecessary Privileges in IceWhaleTech ZimaOS affecting IceWhaleTech ZimaOS. Get real-time up

CVE-2025-58431: CWE-250: Execution with Unnecessary Privileges in IceWhaleTech ZimaOS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-58431: CWE-250: Execution with Unnecessary Privileges in IceWhaleTech ZimaOS

Threats Tagged 'cve-2025-58431'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-58431'

Lead Pen Test Professional