Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

node-tar

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

CVE-2025-64118 is a concurrency-related vulnerability classified under CWE-362 (Race Condition) and CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) affecting the node-tar package version 7.5.1, a widely used Node.js library for handling tar archives. The issue arises when the .t (or .list) method is invoked with the { sync: true } option to synchronously read tar entry contents. If the tar file on disk is truncated to a smaller size during the read operation, the method may return uninitialized memory contents instead of valid data. This occurs due to improper synchronization and lack of atomicity in file size checks and reads, allowing a race condition between file modification and reading. The vulnerability can lead to leakage of potentially sensitive memory data, violating confidentiality. Exploitation requires local or low-privilege access to the system where node-tar is used, partial user interaction, and the ability to modify tar files during read operations. The CVSS 4.0 score is 6.1 (medium severity), reflecting the complexity and limited attack vector. The flaw was addressed in node-tar version 7.5.2 by improving synchronization and ensuring safe reads. No public exploits are known at this time. This vulnerability is particularly relevant for applications that process tar files synchronously and may be exposed to concurrent file modifications, such as CI/CD pipelines, build systems, or file extraction services using node-tar 7.5.1.

Detailed information about CVE-2025-64118: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in isaacs node-t

CVE-2025-64118: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in isaacs node-tar - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-64118: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in isaacs node-tar

Threats Tagged 'cve-2025-64118'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-64118'

Lead Pen Test Professional