Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

iccDEV

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6.

CVE-2026-34553 is a medium severity vulnerability in the InternationalColorConsortium's iccDEV library, affecting versions prior to 2.3.1.6. The flaw involves a defect in the lookup table (LUT) dump and iteration logic, specifically in the CIccCLUT::Iterate() method and the output generated by CIccMBB::Describe(), which uses CLUT dumping. The root cause is related to returning the address of a stack variable (CWE-562), which can cause incorrect behavior or logic errors (CWE-665). This defect has been fixed in iccDEV version 2.3.1.6.

Detailed information about CVE-2026-34553: CWE-562: Return of Stack Variable Address in InternationalColorConsortium iccDEV affecting InternationalColorConsorti

CVE-2026-34553: CWE-562: Return of Stack Variable Address in InternationalColorConsortium iccDEV - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-34553: CWE-562: Return of Stack Variable Address in InternationalColorConsortium iccDEV

bind9

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

CVE-2026-3591 is a use-after-return vulnerability identified in the ISC BIND 9 DNS server software, specifically affecting versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and their corresponding S1 variants. The vulnerability arises in the 'named' server component when processing DNS queries signed with SIG(0), a DNS security extension used for transaction signatures. The flaw involves the server returning the address of a stack variable that is no longer valid, leading to undefined behavior during ACL evaluation. This can cause an ACL to incorrectly match an IP address, potentially allowing unauthorized clients to bypass IP-based access restrictions. The issue is particularly impactful in default-allow ACL configurations, where only specific IPs are denied, as the mis-match can grant unintended access. Conversely, default-deny ACLs, which deny all except explicitly allowed IPs, tend to fail-secure, reducing risk. The vulnerability does not affect earlier stable branches such as 9.18.x. The CVSS v3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges, and no user interaction. No public exploits or active exploitation have been reported to date. The root cause is classified under CWE-562 (return of stack variable address), indicating a programming error leading to use-after-return conditions. The vulnerability underscores the risks of subtle memory handling bugs in critical DNS infrastructure software.

Detailed information about CVE-2026-3591: CWE-562 Return of Stack Variable Address in ISC BIND 9 affecting ISC BIND 9. Get real-time updates, technical details,

CVE-2026-3591: CWE-562 Return of Stack Variable Address in ISC BIND 9 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-3591: CWE-562 Return of Stack Variable Address in ISC BIND 9


CVE-2026-34553: CWE-562: Return of Stack Variable Address in InternationalColorConsortium iccDEVCVE-2026-34553 0 iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6. MediumVulnerability#cve #cve-2026-34553 #cwe-562 Join the discussion	CVE Database V5	03/31/2026, 22:17:30 UTC Added: 04/01/2026, 19:47:29 UTC
CVE-2026-3591: CWE-562 Return of Stack Variable Address in ISC BIND 9CVE-2026-3591 0 A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. MediumVulnerabilityUnited StatesGermanyUnited Kingdom+9#cve #cve-2026-3591 #cwe-562 Join the discussion	CVE Database V5	03/25/2026, 13:34:14 UTC Added: 03/25/2026, 14:01:10 UTC

Threats Tagged 'cwe-562'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cwe-562'

Lead Pen Test Professional