Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

application-gateway

IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

CVE-2025-36397 is an HTML injection vulnerability classified under CWE-80, affecting IBM Application Gateway versions 23.10 through 25.09. This vulnerability arises from improper neutralization of script-related HTML tags, allowing an authenticated remote attacker to inject malicious HTML code into web pages served by the gateway. When a victim views the compromised page, the injected code executes within the security context of the hosting site, potentially enabling theft of sensitive information, session hijacking, or manipulation of displayed content. The vulnerability requires the attacker to have some level of privileges (PR:L) and user interaction (UI:R) to be exploited, which limits its ease of exploitation. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the initially vulnerable component. The CVSS 3.1 base score is 5.4, indicating medium severity. No public exploit code or active exploitation has been reported to date. The lack of a patch link suggests that remediation may require vendor updates or configuration changes. This vulnerability is particularly relevant for organizations relying on IBM Application Gateway for secure web traffic management, as it could undermine trust in web applications and expose users to client-side attacks.

Detailed information about CVE-2025-36397: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in IBM Application Gateway affec

CVE-2025-36397: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in IBM Application Gateway - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-36397: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in IBM Application Gateway

Application-Gateway

IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36396 is a cross-site scripting (XSS) vulnerability classified under CWE-79 affecting IBM Application Gateway versions 23.10 through 25.09. This vulnerability arises from improper neutralization of input during web page generation, allowing an authenticated user to inject arbitrary JavaScript code into the web UI. The injected script can manipulate the interface's intended behavior, potentially leading to the disclosure of sensitive information such as user credentials within an active trusted session. The vulnerability requires the attacker to have legitimate access credentials and to interact with the system to execute the attack, which limits the attack surface but does not eliminate risk. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 score of 5.4 reflects a medium severity, with network attack vector, low attack complexity, and privileges required. No patches or exploits are currently publicly available, but the vulnerability is officially published and should be addressed promptly. The issue highlights the importance of proper input validation and output encoding in web applications, especially in administrative interfaces that manage critical network functions.

Detailed information about CVE-2025-36396: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM Application Gatewa

CVE-2025-36396: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM Application Gateway - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-36396: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM Application Gateway


CVE-2025-36397: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in IBM Application GatewayCVE-2025-36397 0 IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-36397 #cwe-80 Join the discussion	CVE Database V5	01/20/2026, 15:23:30 UTC Added: 01/20/2026, 15:35:56 UTC
CVE-2025-36396: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM Application GatewayCVE-2025-36396 0 IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-36396 #cwe-79 Join the discussion	CVE Database V5	01/20/2026, 15:22:11 UTC Added: 01/20/2026, 15:35:56 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional