Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ChatLuck

ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.

CVE-2025-58115 is a cross-site scripting (XSS) vulnerability identified in the Guest User Sign-up feature of ChatLuck, a collaboration/chat software developed by NEOJAPAN Inc. The affected versions range from V3.6 R1.0 to V6.6 R1.0. This vulnerability allows an attacker to inject malicious JavaScript code into the application interface, which executes in the context of the victim's browser when they access the affected page. The vulnerability is classified as reflected or stored XSS depending on how the input is handled, but the details specify arbitrary script execution on user browsers, indicating potential stored XSS. The CVSS v3.0 score is 6.1 (medium), with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and impacts on confidentiality and integrity (C:L/I:L), but no impact on availability (A:N). The scope change indicates that the vulnerability affects components beyond the initially vulnerable component, potentially impacting other parts of the system or user sessions. Exploitation requires the victim to interact with maliciously crafted content, such as clicking a link or submitting a form. The vulnerability can be leveraged to steal session cookies, perform actions on behalf of the user, or deliver further malware payloads. No public exploits or patches are currently available, but the vulnerability is publicly disclosed and should be addressed promptly. The vulnerability was reserved on 2025-09-02 and published on 2025-10-16 by JPCERT, indicating a recent discovery and disclosure.

Detailed information about CVE-2025-58115: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuck affecting NEOJAPAN Inc. ChatLuck. Get real-time updates, technic

CVE-2025-58115: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuck - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-58115: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuck

ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user.

CVE-2025-54461 identifies an access control vulnerability in the ChatLuck communication platform developed by NEOJAPAN Inc., specifically affecting versions V6.6 R2.0 and earlier. The vulnerability arises from insufficient granularity in the mechanism that governs the invitation and registration of guest users. Normally, guest user invitations should be tightly controlled to prevent unauthorized users from gaining access. However, due to this flaw, an uninvited user can bypass intended restrictions and register themselves as a guest user without any prior authorization. The vulnerability is remotely exploitable over the network without requiring any authentication or user interaction, which increases the attack surface. The CVSS 3.0 base score is 5.3, reflecting a medium severity level, primarily due to the limited confidentiality impact and no direct effect on integrity or availability. Exploitation could allow unauthorized access to guest-level communication channels or data, potentially exposing sensitive internal discussions or information shared within the platform. No public exploits or active exploitation have been reported to date. The lack of a patch link suggests that a fix may still be pending or in development. Organizations using ChatLuck should monitor vendor communications for patches and consider interim controls such as restricting guest user invitations and monitoring guest account activity. This vulnerability highlights the importance of robust access control mechanisms in collaborative communication tools to prevent unauthorized access and data exposure.

Detailed information about CVE-2025-54461: Insufficient Granularity of Access Control in NEOJAPAN Inc. ChatLuck affecting NEOJAPAN Inc. ChatLuck. Get real-time 

CVE-2025-54461: Insufficient Granularity of Access Control in NEOJAPAN Inc. ChatLuck - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-54461: Insufficient Granularity of Access Control in NEOJAPAN Inc. ChatLuck

ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.

CVE-2025-53858 is a cross-site scripting (XSS) vulnerability identified in the ChatLuck chat application developed by NEOJAPAN Inc., affecting versions V6.6 R2.0 and earlier. The vulnerability resides in the chat rooms feature, where insufficient input sanitization allows an attacker to inject malicious JavaScript code. When a user accesses a compromised chat room, the injected script executes within their browser context, potentially enabling theft of session cookies, credential theft, or manipulation of the user interface. The CVSS v3.0 base score is 5.4, indicating a medium severity level. The vector string (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reveals that the attack can be launched remotely over the network with low attack complexity, requires privileges (likely authenticated user access), and user interaction (clicking or viewing the malicious message). The scope is changed (S:C), meaning the vulnerability affects resources beyond the initially vulnerable component, increasing risk. Confidentiality and integrity are impacted, but availability remains unaffected. No public exploits have been reported yet, but the vulnerability's presence in a communication tool used for collaboration raises concerns about potential phishing or session hijacking attacks. The lack of available patches at the time of publication necessitates immediate attention from administrators. The vulnerability was reserved on 2025-09-02 and published on 2025-10-16, indicating recent discovery and disclosure.

Detailed information about CVE-2025-53858: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuck affecting NEOJAPAN Inc. ChatLuck. Get real-time updates, technic


CVE-2025-58115: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuckCVE-2025-58115 0 ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-58115 Join the discussion	CVE Database V5	10/16/2025, 08:55:14 UTC Added: 10/16/2025, 09:04:08 UTC
CVE-2025-54461: Insufficient Granularity of Access Control in NEOJAPAN Inc. ChatLuckCVE-2025-54461 0 ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user. MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-54461 Join the discussion	CVE Database V5	10/16/2025, 08:55:03 UTC Added: 10/16/2025, 09:04:08 UTC
CVE-2025-53858: Cross-site scripting (XSS) in NEOJAPAN Inc. ChatLuckCVE-2025-53858 0 ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product. MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-53858 Join the discussion	CVE Database V5	10/16/2025, 08:54:46 UTC Added: 10/16/2025, 09:04:08 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional