Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.

The vulnerability CVE-2026-22686 affects the agentfront enclave-vm, a secure JavaScript sandbox designed to safely execute AI agent code within Node.js environments. Prior to version 2.7.0, enclave-vm improperly exposes a host-side Error object to sandboxed code when a tool invocation fails. This Error object retains its host realm prototype chain, which can be traversed by malicious sandboxed code to reach the host Function constructor. By intentionally triggering a host error, an attacker can climb this prototype chain and use the Function constructor to compile and execute arbitrary JavaScript code in the host Node.js runtime context. This effectively breaks the sandbox's core security guarantee of isolating untrusted code, allowing full access to sensitive host resources such as process environment variables, filesystem, and network interfaces. The vulnerability is categorized under CWE-693 (Protection Mechanism Failure) and CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 10.0 (critical), reflecting the vulnerability's ease of exploitation (no privileges or user interaction required), network attack vector, and complete impact on confidentiality, integrity, and availability. The issue was publicly disclosed on January 13, 2026, and fixed in enclave version 2.7.0. No known exploits have been reported in the wild to date.

Detailed information about CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave affecting agentfront enclave. Get real-time updates, tech

CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-22686: CWE-693: Protection Mechanism Failure in agentfront enclave

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.

CVE-2026-0716 is a vulnerability identified in the libsoup library, specifically in its WebSocket frame processing component used by Red Hat Enterprise Linux 10. The flaw arises when the library handles incoming WebSocket messages under a non-default configuration where the maximum incoming payload size is not set. In this scenario, libsoup may read memory beyond the intended buffer boundaries, leading to out-of-bounds memory access. This can result in unintended exposure of memory contents or cause the application to crash due to memory corruption. The vulnerability does not require authentication or user interaction but does require network access to exploit, as it involves processing incoming WebSocket frames. The CVSS 3.1 base score is 4.8 (medium), with the vector indicating network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), limited confidentiality impact (C:L), no integrity impact (I:N), and low availability impact (A:L). No known public exploits have been reported to date. The vulnerability affects applications that utilize libsoup’s WebSocket support with the specific configuration of an unset maximum payload size, which may not be the default setting. This suggests that only certain deployments or custom configurations are vulnerable. The flaw is significant because WebSocket is widely used for real-time web communications, and libsoup is a common HTTP client/server library in Linux environments. Exploitation could lead to information disclosure or denial of service via application crashes. Red Hat Enterprise Linux 10 users should review their libsoup configurations and apply patches once available to prevent exploitation.

Detailed information about CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10 affecting Red Hat Red Hat Enterprise 

CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0716: Buffer Access with Incorrect Length Value in Red Hat Red Hat Enterprise Linux 10

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

CVE-2026-23478 is a critical security vulnerability identified in the open-source scheduling software cal.com, affecting versions from 3.1.6 up to but not including 6.0.7. The root cause lies in a custom NextAuth JWT callback implementation that improperly enforces security controls on the client side rather than the server side. Specifically, the session.update() function accepts a target email address parameter without adequate server-side validation, enabling an attacker to impersonate any user by supplying their email address. This bypasses authentication mechanisms, granting the attacker full authenticated access to the victim's account. The vulnerability is classified under CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates the vulnerability is remotely exploitable over the network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and results in high confidentiality, integrity, and availability impacts (VC:H, VI:H, VA:H). The scope is high (S:H), meaning the vulnerability affects resources beyond the initially vulnerable component. Although no known exploits are reported in the wild yet, the critical severity and ease of exploitation make it a significant threat. The vulnerability is resolved in cal.com version 6.0.7 by enforcing proper server-side validation of session updates and restricting unauthorized email parameter manipulation.

Detailed information about CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com affecting calcom cal.com. Get real-time up

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-Side Security in calcom cal.com

NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.

CVE-2025-68947 identifies a missing authorization vulnerability (CWE-862) in the NSecsoft NSecKrnl Windows driver. NSecKrnl is a kernel-mode driver that facilitates certain system-level operations. The vulnerability allows a local attacker with low privileges to send specially crafted IOCTL (Input Output Control) requests to the driver, bypassing authorization checks. This enables the attacker to terminate processes owned by other users, including highly privileged SYSTEM processes and Protected Processes, which are normally shielded from termination to maintain system stability and security. The flaw arises because the driver fails to verify whether the requesting user has sufficient permissions to perform process termination operations. Exploiting this vulnerability does not require user interaction but does require local authenticated access, limiting remote exploitation. The CVSS v3.1 score of 4.7 reflects the medium severity, with attack vector local (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and impact limited to availability (A:H) without affecting confidentiality or integrity. No patches or known exploits are currently available, but the vulnerability poses a risk of denial of service or disruption by terminating critical system processes.

Detailed information about CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NSecKrnl affecting NSecsoft NSecKrnl. Get real-time updates, technical deta

CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NSecKrnl - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NSecKrnl

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

CVE-2026-0543 is a vulnerability identified in Elastic Kibana's Email Connector component, classified under CWE-20 (Improper Input Validation). The flaw arises when the connector processes email address parameters without adequate validation, allowing an attacker to craft an input that causes excessive memory allocation (CAPEC-130). This excessive allocation leads to resource exhaustion, resulting in a denial-of-service (DoS) condition that renders the Kibana service completely unavailable to all users until a manual restart is performed. Exploitation requires the attacker to have authenticated access with at least view-level privileges sufficient to execute connector actions, but no further user interaction is necessary. The vulnerability affects multiple major Kibana versions (7.0.0, 8.0.0, 9.0.0, and 9.2.0), indicating a broad impact across deployments. The CVSS v3.1 score is 6.5 (medium severity), reflecting the network attack vector, low attack complexity, required privileges, no user interaction, and impact limited to availability. No known public exploits have been reported yet, but the potential for service disruption is significant, especially in environments relying heavily on Kibana for operational monitoring and alerting. The vulnerability underscores the importance of robust input validation in connectors that process external data, even from authenticated users.

Detailed information about CVE-2026-0543: CWE-20 Improper Input Validation in Elastic Kibana affecting Elastic Kibana. Get real-time updates, technical details,

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

CVE-2026-22686: CWE-693: Protection Mechanism Failure in age...

CVE-2026-0716: Buffer Access with Incorrect Length Value in ...

CVE-2026-23478: CWE-602: Client-Side Enforcement of Server-S...

CVE-2025-68947: CWE-862 Missing Authorization in NSecsoft NS...

CVE-2026-0543: CWE-20 Improper Input Validation in Elastic K...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility