Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

nginx

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.   


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-28755 is a vulnerability in the ngx_stream_ssl_module of F5's NGINX Open Source and NGINX Plus products. It occurs when the server is configured with ssl_verify_client enabled to require client certificate verification and ssl_ocsp enabled to perform Online Certificate Status Protocol (OCSP) checks to validate certificate revocation status. Due to improper handling of revoked certificates, the TLS handshake can still succeed even if the OCSP responder indicates the client certificate has been revoked. This results in an incorrect authorization condition classified under CWE-863, where the system grants access despite failed authorization checks. The vulnerability affects versions 1.27.2 and 1.29.0 of NGINX Open Source. Exploitation requires an attacker to present a revoked client certificate during the TLS handshake. The attacker can bypass revocation checks, potentially gaining unauthorized access to services protected by client certificate authentication. The vulnerability does not affect software versions that have reached End of Technical Support (EoTS). The CVSS v3.1 base score is 5.4, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requires privileges to present a client certificate, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no availability impact. No public exploits are known at this time, but the flaw undermines the trust model of TLS client authentication and could be leveraged in targeted attacks against sensitive environments.

Detailed information about CVE-2026-28755: CWE-863 Incorrect Authorization in F5 NGINX Open Source affecting F5 NGINX Open Source. Get real-time updates, techni

CVE-2026-28755: CWE-863 Incorrect Authorization in F5 NGINX Open Source - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-28755: CWE-863 Incorrect Authorization in F5 NGINX Open Source

Threats Tagged 'bit-nginx-2026-28755'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'bit-nginx-2026-28755'

Lead Pen Test Professional