Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

mediawiki-extensions-Bucket

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Bucket table field that has a PAGE type, which will execute whenever a user views that table's corresponding Bucket namespace page. This vulnerability is fixed in 2.1.1.

CVE-2026-30917 is a stored Cross-site Scripting (XSS) vulnerability identified in the weirdgloop MediaWiki extension named Bucket, which is designed to store and retrieve structured data on articles. The vulnerability exists in all versions prior to 2.1.1 and is caused by improper neutralization of input during web page generation, classified under CWE-79. Specifically, an attacker can inject malicious JavaScript payloads into any Bucket table field that is of PAGE type. When a user views the Bucket namespace page corresponding to the affected table, the injected script executes in the context of the victim's browser. This stored XSS does not require any authentication or user interaction, making it remotely exploitable over the network. The vulnerability can lead to session hijacking, credential theft, defacement, or further exploitation of the victim's environment. The CVSS 4.0 base score is 8.8, reflecting its high severity, with attack vector as network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact on confidentiality (VC:H), with lower impacts on integrity and availability. Although no known exploits have been reported in the wild, the vulnerability poses a significant risk to any MediaWiki instance using the Bucket extension before version 2.1.1. The issue was publicly disclosed on March 9, 2026, and fixed in version 2.1.1. The lack of patch links in the provided data suggests users should obtain updates directly from the official weirdgloop or MediaWiki extension repositories. The vulnerability's exploitation could compromise the confidentiality and integrity of data managed within MediaWiki platforms, potentially affecting organizational knowledge bases and collaborative workflows.

Detailed information about CVE-2026-30917: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in weirdgloop mediawiki-

CVE-2026-30917: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in weirdgloop mediawiki-extensions-Bucket - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-30917: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in weirdgloop mediawiki-extensions-Bucket

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional