Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

rainrock-rockoa

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-0588 identifies a cross-site scripting (XSS) vulnerability in Xinhu Rainrock RockOA, an office automation platform, affecting versions 2.7.0 and 2.7.1. The vulnerability resides in the rockfun.php file within the API component, where the 'callback' parameter is improperly sanitized. This allows an attacker to inject malicious JavaScript code that executes in the context of the victim's browser when they access a crafted URL. The attack vector is remote and does not require prior authentication, but user interaction is necessary to trigger the payload. The vulnerability leverages reflected XSS, which can be used to steal session cookies, perform actions on behalf of the user, or redirect users to malicious sites. The vendor was notified early but has not issued a patch or response, and no official fixes or mitigations have been published. The CVSS v4.0 score is 5.1, reflecting medium severity due to the ease of exploitation and potential impact on confidentiality and integrity, but limited impact on availability. No known exploits are currently active in the wild, but public disclosure increases the risk of exploitation attempts. Organizations using RockOA should assess exposure and implement compensating controls while awaiting vendor remediation.

Detailed information about CVE-2026-0588: Cross Site Scripting in Xinhu Rainrock RockOA affecting Xinhu Rainrock RockOA. Get real-time updates, technical detail

CVE-2026-0588: Cross Site Scripting in Xinhu Rainrock RockOA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0588: Cross Site Scripting in Xinhu Rainrock RockOA

A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-0587 is a cross-site scripting (XSS) vulnerability identified in Xinhu Rainrock RockOA, a widely used office automation platform, specifically in versions 2.7.0 and 2.7.1. The vulnerability resides in the rock_page_gong.php file within the Cover Image Handler component. The issue stems from improper sanitization of the 'fengmian' parameter, which can be manipulated by an attacker to inject arbitrary JavaScript code. This flaw is exploitable remotely without requiring authentication, although it necessitates user interaction to execute the malicious payload, such as clicking a crafted link or visiting a malicious page. The vendor was notified early but has not provided a patch or response, and public exploit code has been released, increasing the likelihood of exploitation in the wild. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the ease of remote exploitation but limited impact on confidentiality and availability. The vulnerability can be leveraged to perform session hijacking, steal credentials, or conduct phishing attacks within the RockOA environment, potentially compromising sensitive organizational data. The lack of vendor response and absence of official patches necessitate immediate defensive measures by users of the affected versions.

Detailed information about CVE-2026-0587: Cross Site Scripting in Xinhu Rainrock RockOA affecting Xinhu Rainrock RockOA. Get real-time updates, technical detail

CVE-2026-0587: Cross Site Scripting in Xinhu Rainrock RockOA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0587: Cross Site Scripting in Xinhu Rainrock RockOA


CVE-2026-0588: Cross Site Scripting in Xinhu Rainrock RockOACVE-2026-0588 0 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityChinaSingaporeMalaysia+7#cve #cve-2026-0588 Join the discussion	CVE Database V5	01/05/2026, 11:32:05 UTC Added: 01/05/2026, 11:48:10 UTC
CVE-2026-0587: Cross Site Scripting in Xinhu Rainrock RockOACVE-2026-0587 0 A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityChinaTaiwanSingapore+7#cve #cve-2026-0587 Join the discussion	CVE Database V5	01/05/2026, 11:02:05 UTC Added: 01/05/2026, 11:13:22 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional