Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

kyuubi

org.apache.kyuubi:kyuubi-server

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.

This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.

Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

CVE-2025-66518 is a path traversal vulnerability (CWE-27) affecting Apache Kyuubi, an open-source distributed SQL query engine for large-scale data processing. The flaw exists in the handling of file paths when clients access the Kyuubi server via its frontend protocols. Specifically, the server-side configuration parameter 'kyuubi.session.local.dir.allow.list', which is intended to restrict access to certain local directories, can be bypassed by crafting path traversal sequences such as 'dir/../../filename'. This allows an attacker with access to the Kyuubi frontend protocols to read local files outside the allowed directories. The vulnerability affects versions 1.6.0 through 1.10.2 and was fixed in version 1.10.3. Exploitation requires the attacker to have at least limited privileges (low privileges) and some user interaction, but no elevated privileges or complex conditions. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L) indicates network attack vector, low attack complexity, partial authentication, and partial user interaction, with high impact on confidentiality and integrity, and low impact on availability. The vulnerability could lead to unauthorized disclosure of sensitive files, potentially exposing credentials, configuration files, or other critical data, which could further facilitate lateral movement or privilege escalation within affected environments.

Detailed information about CVE-2025-66518: CWE-27 Path Traversal: 'dir/../../filename' in Apache Software Foundation Apache Kyuubi affecting Apache Software Fou

CVE-2025-66518: CWE-27 Path Traversal: 'dir/../../filename' in Apache Software Foundation Apache Kyuubi - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-66518: CWE-27 Path Traversal: 'dir/../../filename' in Apache Software Foundation Apache Kyuubi

Threats Tagged 'cve-2025-66518'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-66518'

Lead Pen Test Professional