Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 contain an authorization bypass vulnerability. This flaw arises from improper mapping of untrusted URL query parameters, allowing attackers to bypass authorization controls. The vulnerability is identified as CWE-639, related to authorization bypass through user-controlled keys. It has a high severity with a CVSS score of 7.4.

CVE-2026-19651 affects IBM Enterprise Build of Quarkus in versions 3.27.1 to 3.27.5 and 3.33.1 to 3.33.3. The vulnerability is due to incorrect handling of URL query parameters, which can be manipulated by an attacker to bypass authorization mechanisms. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 score is 7.4, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability.

Detailed information about CVE-2026-19651: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Enterprise Build of Quarkus affecting IBM Enterprise 

CVE-2026-19651: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Enterprise Build of Quarkus - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-19651: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Enterprise Build of Quarkus

A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. Red Hat has released an update (RHBQ 3.33.3.SP1) that addresses this and other vulnerabilities. The update is rated as important by Red Hat Product Security.

CVE-2026-12894 is a Server-Side Template Injection vulnerability in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This vulnerability allows attackers who can control template input to bypass security restrictions and execute unauthorized commands on the server. The issue affects versions from 3.27.0 through 3.33.0 inclusive. Red Hat has released an update, RHBQ 3.33.3.SP1, which includes a fix for this vulnerability along with other security issues. The advisory rates the security impact as important.

Detailed information about A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. (CVE-20

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. (CVE-2026-12894) - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/security/updates/classification/#important

https://access.redhat.com/security/cve/CVE-2026-64607

https://access.redhat.com/security/cve/CVE-2026-62243

https://access.redhat.com/security/cve/CVE-2026-71290

https://access.redhat.com/security/cve/CVE-2026-66257

https://access.redhat.com/security/cve/CVE-2026-66273

https://access.redhat.com/security/cve/CVE-2026-18710

https://access.redhat.com/security/cve/CVE-2026-17615

https://access.redhat.com/security/cve/CVE-2026-66274

2507635

2509736

2511322

2511326

2511337

2514394

2514429

2521309

Canonical URL

https://access.redhat.com/products/quarkus/

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=3.27.5.SP1

https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)


CVE-2026-19651: CWE-639 Authorization Bypass Through User-Controlled Key in IBM Enterprise Build of QuarkusCVE-2026-19651 0 IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 contain an authorization bypass vulnerability. This flaw arises from improper mapping of untrusted URL query parameters, allowing attackers to bypass authorization controls. The vulnerability is identified as CWE-639, related to authorization bypass through user-controlled keys. It has a high severity with a CVSS score of 7.4. HighVulnerability#cve #cve-2026-19651 #cwe-639 Join the discussion	CVE Database V5	09/08/2026, 20:14:12 UTC Added: 09/08/2026, 20:38:15 UTC
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)CVE-2026-12894 0 A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. Red Hat has released an update (RHBQ 3.33.3.SP1) that addresses this and other vulnerabilities. The update is rated as important by Red Hat Product Security. HighVulnerability#gcve #osv #ghsa-w5gv-wrvc-9hx8 Join the discussion	GCVE Database	09/03/2026, 18:34:09 UTC Added: 08/31/2026, 17:51:01 UTC

Threats Tagged 'cve-2026-19651'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-19651'

Lead Pen Test Professional