Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

This vulnerability affects IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3. When multiple endpoints are secured by distinct OIDC providers and token introspection caching is enabled, a token valid for one provider's endpoint can be incorrectly accepted by another provider's endpoint. This results from improper access control (CWE-284) in the token validation logic, allowing cross-tenant token reuse.

Detailed information about CVE-2026-19625: CWE-284 Improper Access Control in IBM Enterprise Build of Quarkus affecting IBM Enterprise Build of Quarkus. Get rea

CVE-2026-19625: CWE-284 Improper Access Control in IBM Enterprise Build of Quarkus - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-19625: CWE-284 Improper Access Control in IBM Enterprise Build of Quarkus

A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. Red Hat has released an update (RHBQ 3.33.3.SP1) that addresses this and other vulnerabilities. The update is rated as important by Red Hat Product Security.

CVE-2026-12894 is a Server-Side Template Injection vulnerability in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This vulnerability allows attackers who can control template input to bypass security restrictions and execute unauthorized commands on the server. The issue affects versions from 3.27.0 through 3.33.0 inclusive. Red Hat has released an update, RHBQ 3.33.3.SP1, which includes a fix for this vulnerability along with other security issues. The advisory rates the security impact as important.

Detailed information about A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. (CVE-20

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. (CVE-2026-12894) - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/security/updates/classification/#important

https://access.redhat.com/security/cve/CVE-2026-64607

https://access.redhat.com/security/cve/CVE-2026-62243

https://access.redhat.com/security/cve/CVE-2026-71290

https://access.redhat.com/security/cve/CVE-2026-66257

https://access.redhat.com/security/cve/CVE-2026-66273

https://access.redhat.com/security/cve/CVE-2026-18710

https://access.redhat.com/security/cve/CVE-2026-17615

https://access.redhat.com/security/cve/CVE-2026-66274

2507635

2509736

2511322

2511326

2511337

2514394

2514429

2521309

Canonical URL

https://access.redhat.com/products/quarkus/

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.27.5.SP1

https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)


CVE-2026-19625: CWE-284 Improper Access Control in IBM Enterprise Build of QuarkusCVE-2026-19625 0 When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2. MediumVulnerability#cve #cve-2026-19625 #cwe-284 Join the discussion	CVE Database V5	09/08/2026, 20:18:52 UTC Added: 09/08/2026, 20:38:15 UTC
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)CVE-2026-12894 0 A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. Red Hat has released an update (RHBQ 3.33.3.SP1) that addresses this and other vulnerabilities. The update is rated as important by Red Hat Product Security. HighVulnerability#gcve #osv #ghsa-w5gv-wrvc-9hx8 Join the discussion	GCVE Database	09/03/2026, 18:34:09 UTC Added: 08/31/2026, 17:51:01 UTC

Threats Tagged 'cve-2026-19625'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-19625'

Lead Pen Test Professional