Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

github.com/cloudreve/Cloudreve/v4

github.com/cloudreve/Cloudreve/v3

Cloudreve v4 exposes two admin node test endpoints that require only the Admin.Read OAuth scope but allow triggering server-side network requests to attacker-controlled URLs. This enables an attacker with an Admin.Read-only OAuth token to perform blind SSRF and internal service probing, actions that should require Admin.Write scope. The issue was verified in version 4.16.1 and the latest master commit. The root cause is missing Admin.Write scope enforcement on these test endpoints, which perform outbound network requests using attacker-supplied configuration.

Cloudreve v4 has a vulnerability where two admin node test endpoints under the Admin.Read OAuth scope accept attacker-controlled node definitions and cause the server to make outbound network requests. Although node create, update, and delete routes require Admin.Write scope, these test endpoints do not, allowing an attacker with only Admin.Read scope to trigger server-side requests to arbitrary URLs. This was confirmed on version 4.16.1 and the latest master commit. The issue arises because the route group enforces Admin.Read by default and relies on per-route Admin.Write middleware for state-mutating operations, but the test endpoints were omitted from this stricter scope requirement. The vulnerability enables blind SSRF, internal service probing, and triggering signed requests to attacker-chosen endpoints.

Detailed information about V4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests affecting null github.com/cloudreve/Cloudreve/v4. Ge

V4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests - Live Threat Intelligence - Threat Radar | OffSeq.com

V4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Threats Tagged 'ghsa-v6w6-358x-2433'