Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

caddy

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

CVE-2026-27585 is a vulnerability in the Caddy web server platform, identified as CWE-20 (Improper Input Validation). The issue arises from the path sanitization routine within Caddy's file matcher component, which fails to sanitize backslash characters ('\') in file paths. This flaw exists in all Caddy versions prior to 2.11.1. Because backslashes are not properly handled, attackers can craft specially formed requests that bypass path-related security controls, potentially allowing unauthorized access to files or directories outside the intended scope. This can lead to information disclosure or unauthorized file retrieval. The vulnerability is exploitable remotely without requiring authentication or user interaction, increasing its risk profile. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact on integrity (VI:H) but no impact on confidentiality or availability. The vulnerability is fixed in Caddy version 2.11.1 by enhancing the path sanitization logic to properly handle backslashes, closing the bypass vector. No public exploits have been reported yet, but the vulnerability's nature makes it a candidate for exploitation in environments where Caddy is used as a web server or reverse proxy with file serving enabled and path sanitization relied upon for security.

Detailed information about CVE-2026-27585: CWE-20: Improper Input Validation in caddyserver caddy affecting caddyserver caddy. Get real-time updates, technical 

CVE-2026-27585: CWE-20: Improper Input Validation in caddyserver caddy - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-27585: CWE-20: Improper Input Validation in caddyserver caddy

Threats Tagged 'cve-2026-27585'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-27585'

Lead Pen Test Professional