Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2026-27456 is a TOCTOU race condition vulnerability in the util-linux mount program affecting Red Hat Hardened Images. When an /etc/fstab entry is configured with user,loop options, mount checks the file path with user permissions but opens it with root privileges, creating a brief window where an attacker can replace the intended file with a malicious symbolic link. This allows a local unprivileged user to mount any root-owned file or block device containing a valid filesystem, gaining full read access to its contents. The vulnerability does not enable arbitrary code execution or memory corruption. Exploitation requires that the source path in /etc/fstab points to a directory writable by the attacker (e.g., the user's home directory). The advisory recommends removing the 'user' option from loop mounts or ensuring the source path is root-owned and not writable by unprivileged users. No explicit patch or fix release is confirmed in the vendor advisory content provided.

Detailed information about Red Hat Security Advisory: util-linux security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical de

Red Hat Security Advisory: util-linux security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2026:7180

https://images.redhat.com/

https://access.redhat.com/security/cve/CVE-2026-27456

https://access.redhat.com/security/updates/classification/

https://access.redhat.com/security/cve/CVE-2025-14104

https://access.redhat.com/security/cve/CVE-2026-3184

Canonical URL

https://access.redhat.com/errata/RHSA-2026:1696

https://access.redhat.com/security/updates/classification/#moderate

2419369

https://access.redhat.com/errata/RHSA-2026:1852

https://access.redhat.com/errata/RHSA-2026:1913

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

The vulnerability CVE-2026-3184 affects the util-linux package's login(1) utility in Red Hat Hardened Images. When the login utility is invoked with the -h option, it improperly canonicalizes the supplied remote hostname, modifying it before setting the PAM_RHOST environment variable. This can be exploited by a remote attacker who provides a specially crafted hostname to bypass host-based Pluggable Authentication Modules (PAM) access control rules that depend on fully qualified domain names. The issue is classified as low severity with a CVSS score of 3.7, reflecting network attack vector with high attack complexity and no privileges required. The Red Hat advisory does not explicitly confirm a patch or remediation level for this vulnerability.

Detailed information about CVE-2026-3184: Authentication Bypass by Alternate Name in Red Hat Red Hat Enterprise Linux 10 affecting Red Hat Red Hat Enterprise Li

CVE-2026-3184: Authentication Bypass by Alternate Name in Red Hat Red Hat Enterprise Linux 10 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-3184: Authentication Bypass by Alternate Name in Red Hat Red Hat Hardened Images


Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateCVE-2025-14104 0 This update includes the following RPMs: MediumVulnerability#gcve #csaf #cve-2025-14104 Join the discussion	GCVE Database	04/09/2026, 01:57:03 UTC Added: 06/02/2026, 21:43:34 UTC
CVE-2026-3184: Authentication Bypass by Alternate Name in Red Hat Red Hat Hardened ImagesCVE-2026-3184 0 A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. LowVulnerability#cve #cve-2026-3184 #gcve Join the discussion	CVE Database V5	04/03/2026, 18:43:45 UTC Added: 04/03/2026, 19:15:30 UTC

Threats Tagged 'cve-2026-3184'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-3184'

Lead Pen Test Professional