Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

CVE-2026-0696 identifies a security weakness in ConnectWise PSA, a widely used professional services automation platform, where session cookies are not set with the HttpOnly attribute in versions prior to 2026.1. The HttpOnly flag is a critical security control that prevents client-side scripts from accessing cookie data, thereby protecting session tokens from theft via cross-site scripting (XSS) attacks. Without this flag, if an attacker manages to inject malicious JavaScript into a user's browser context—through phishing, XSS vulnerabilities, or malicious third-party content—they can read session cookies and potentially hijack user sessions. The vulnerability is classified under CWE-1004, which concerns sensitive cookies missing the HttpOnly attribute. The CVSS 3.1 base score of 6.5 reflects a medium severity, with an attack vector over the network, low attack complexity, no privileges required, but requiring user interaction. The impact is primarily on confidentiality, as session tokens could be exposed, but integrity and availability are not directly affected. No known exploits have been reported in the wild, but the risk remains significant for environments where attackers can lure users into executing malicious scripts. ConnectWise PSA is commonly used by IT service providers and managed service providers (MSPs), making this vulnerability relevant to organizations relying on these services for IT operations and customer management.

Detailed information about CVE-2026-0696: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag in ConnectWise PSA affecting ConnectWise PSA. Get real-time updates,

CVE-2026-0696: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag in ConnectWise PSA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0696: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag in ConnectWise PSA

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.

CVE-2026-0695 is a stored cross-site scripting (XSS) vulnerability classified under CWE-79, discovered in ConnectWise PSA software versions prior to 2026.1. The flaw is due to improper neutralization of input during web page generation, specifically in the rendering of Time Entry notes stored within the Time Entry Audit Trail. When certain content is entered into these notes, the application fails to apply appropriate output encoding, allowing embedded malicious scripts to execute in the context of a user's browser when viewing the affected content. This vulnerability requires an attacker to have authenticated access with privileges to create or modify Time Entry notes, and successful exploitation also requires user interaction to view the malicious content. The CVSS v3.1 base score is 8.7, indicating high severity, with vector metrics AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, meaning the attack can be launched remotely over the network with low complexity, requires low privileges and user interaction, and impacts confidentiality and integrity with a scope change. Although no known exploits have been reported in the wild, the vulnerability poses a significant risk of session hijacking, credential theft, or unauthorized actions performed on behalf of the victim user. ConnectWise PSA is widely used by managed service providers and IT departments for professional services automation, making this vulnerability particularly relevant for organizations relying on this platform for operational management. The vulnerability was publicly disclosed on January 16, 2026, with no official patch links provided at the time, emphasizing the need for immediate vendor updates or mitigations.

Detailed information about CVE-2026-0695: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in ConnectWise PSA 

CVE-2026-0695: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in ConnectWise PSA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0695: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in ConnectWise PSA


CVE-2026-0696: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag in ConnectWise PSACVE-2026-0696 0 In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values. MediumVulnerabilityUnited KingdomGermanyFrance+4#cve #cve-2026-0696 #cwe-1004 Join the discussion	CVE Database V5	01/16/2026, 13:34:49 UTC Added: 01/16/2026, 13:51:36 UTC
CVE-2026-0695: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in ConnectWise PSACVE-2026-0695 0 In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed. HighVulnerabilityUnited KingdomGermanyFrance+4#cve #cve-2026-0695 #cwe-79 Join the discussion	CVE Database V5	01/16/2026, 13:34:42 UTC Added: 01/16/2026, 13:51:36 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional