Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

CVE-2025-67842 is a vulnerability identified in the Mintlify Platform, specifically in its Static Asset API prior to the patch date of November 15, 2025. The issue stems from the platform's handling of the 'subdomain' parameter, which allows any tenant's static assets to be served on any other tenant's documentation site. This cross-tenant asset serving creates an inclusion of functionality from an untrusted control sphere (CWE-829), enabling remote attackers with limited privileges to inject arbitrary web scripts or HTML content. The vulnerability can be exploited remotely without user interaction, but requires some level of privileges (PR:L), indicating that the attacker must have some authenticated access or tenant-level permissions. The vulnerability leads to a partial compromise of confidentiality and integrity, as attackers could execute malicious scripts in the context of another tenant's documentation site, potentially leading to data leakage, session hijacking, or defacement. The vulnerability does not impact availability. The CVSS v3.1 score is 6.4 (medium), reflecting the network attack vector, low attack complexity, required privileges, no user interaction, and a scope change due to cross-tenant impact. No public exploits are known at this time, and no official patches have been linked, though the vulnerability is reserved and published in December 2025. The root cause is insufficient tenant isolation and improper validation of the subdomain parameter in the Static Asset API, which should enforce strict boundaries between tenants' assets.

Detailed information about CVE-2025-67842: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in Mintlify Mintlify Platform affecting Mintlify Min

CVE-2025-67842: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in Mintlify Mintlify Platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67842: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in Mintlify Mintlify Platform

Threats Tagged 'cve-2025-67842'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-67842'

Lead Pen Test Professional