Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

wget

Multiple security vulnerabilities have been fixed in wget, including server-side request forgery via unvalidated FTP PASV response IP addresses, heap buffer underread from Metalink documents with whitespace-only URLs, integer overflow from server-controlled Content-Range headers, heap memory corruption from character set conversion of server-supplied filenames, and heap buffer overflow from crafted HTML attributes requiring entity encoding. Additional bug fixes address segmentation faults and regressions related to Metalink processing.

This security update for wget addresses several vulnerabilities: CVE-2026-15146 fixes an unvalidated IP address in FTP PASV responses that could lead to server-side request forgery; CVE-2026-58469 resolves a heap buffer underread caused by Metalink documents containing whitespace-only URLs; CVE-2026-58470 patches an integer overflow in parse_content_range() triggered by server-controlled Content-Range headers; CVE-2026-58471 mitigates heap memory corruption from character set conversion of server-supplied filenames; and CVE-2026-58472 fixes a heap buffer overflow caused by crafted HTML attributes with many characters requiring entity encoding. Additional updates fix segmentation faults and regressions in Metalink handling. These fixes are part of a security update released by the SUSE Product Security Team and affect multiple Ubuntu package versions of wget.

Detailed information about UBUNTU-CVE-2026-15146 affecting null wget. Get real-time updates, technical details, and mitigation strategies.

UBUNTU-CVE-2026-15146 - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE ratings

URL of this CSAF notice

SUSE Bug 1271033

SUSE Bug 1271034

SUSE Bug 1271035

SUSE Bug 1271036

SUSE Bug 1271320

SUSE Bug 1272219

SUSE Bug 1273449

SUSE CVE CVE-2026-15146 page

SUSE CVE CVE-2026-58469 page

SUSE CVE CVE-2026-58470 page

SUSE CVE CVE-2026-58471 page

SUSE CVE CVE-2026-58472 page

Security update for wget

GNU Wget versions 1.25.0 and earlier contain a server-side request forgery (SSRF) vulnerability in the FTP passive mode implementation. The vulnerability arises because Wget does not validate IP addresses returned in FTP PASV responses, allowing a malicious FTP server or redirected HTTP-to-FTP URL to redirect Wget's data connection to arbitrary IP addresses and ports. This can expose internal network services to unauthorized access. The issue has been fixed in a recent update by GNU.

CVE-2026-15146 is an SSRF vulnerability in GNU Wget's FTP passive mode where the client does not validate the IP address provided by the FTP server's PASV response. An attacker controlling or influencing the FTP endpoint can redirect Wget's data connection to arbitrary internal IP addresses and ports, potentially accessing internal network resources or localhost services. This vulnerability affects Wget versions 1.25.0 and earlier and was remediated in a commit dated July 5, 2026. The vulnerability is similar to previously known FTP PASV issues such as CVE-2021-40491 in GNU Inetutils.

Detailed information about CVE-2026-15146: CWE-918 Server-Side Request Forgery (SSRF) in GNU wget Wget affecting GNU wget Wget. Get real-time updates, technical

CVE-2026-15146: CWE-918 Server-Side Request Forgery (SSRF) in GNU wget Wget - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-15146: CWE-918 Server-Side Request Forgery (SSRF) in GNU wget Wget


Security update for wgetCVE-2026-15146 0 Multiple security vulnerabilities have been fixed in wget, including server-side request forgery via unvalidated FTP PASV response IP addresses, heap buffer underread from Metalink documents with whitespace-only URLs, integer overflow from server-controlled Content-Range headers, heap memory corruption from character set conversion of server-supplied filenames, and heap buffer overflow from crafted HTML attributes requiring entity encoding. Additional bug fixes address segmentation faults and regressions related to Metalink processing. HighVulnerability#gcve #osv #ubuntu-cve-2026-15146 Join the discussion	GCVE Database	08/27/2026, 06:38:03 UTC Added: 07/16/2026, 10:39:49 UTC
CVE-2026-15146: CWE-918 Server-Side Request Forgery (SSRF) in GNU wget WgetCVE-2026-15146 0 GNU Wget versions 1.25.0 and earlier contain a server-side request forgery (SSRF) vulnerability in the FTP passive mode implementation. The vulnerability arises because Wget does not validate IP addresses returned in FTP PASV responses, allowing a malicious FTP server or redirected HTTP-to-FTP URL to redirect Wget's data connection to arbitrary IP addresses and ports. This can expose internal network services to unauthorized access. The issue has been fixed in a recent update by GNU. MediumVulnerability#cve #cve-2026-15146 #cwe-918 Join the discussion	CVE Database V5	07/10/2026, 18:20:58 UTC Added: 07/10/2026, 19:03:08 UTC

Threats Tagged 'cve-2026-15146'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-15146'

Lead Pen Test Professional