Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device.
 This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.

CVE-2025-20240 is a reflected Cross-Site Scripting (XSS) vulnerability found in the Web Authentication feature of Cisco IOS XE Software. This vulnerability arises from improper sanitization of user-supplied input, specifically within the web interface used for authentication purposes on affected Cisco IOS XE devices. An unauthenticated remote attacker can exploit this flaw by crafting a malicious URL that, when clicked by a legitimate user, causes the device to reflect malicious script code back to the user's browser. This reflected script can then execute in the context of the user's session, potentially allowing the attacker to steal sensitive information such as authentication cookies or session tokens. The vulnerability affects a wide range of Cisco IOS XE versions, spanning from 16.6.1 through 17.16.1a, indicating a long-standing issue across multiple releases. The CVSS v3.1 base score is 6.1 (medium severity), with an attack vector of network (no physical access required), low attack complexity, no privileges required, but user interaction is necessary (the victim must click a malicious link). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the initially vulnerable component. The impact affects confidentiality and integrity but not availability. No known exploits are reported in the wild as of the publication date (September 24, 2025). The vulnerability specifically targets the web authentication interface, which is commonly used in network devices for user login and access control. Because the attack requires user interaction and targets web sessions, the primary risk is theft of user credentials or session hijacking, which could lead to unauthorized access or further compromise of network infrastructure.

Detailed information about CVE-2025-20240: Incomplete Blacklist to Cross-Site Scripting in Cisco Cisco IOS XE Software affecting Cisco Cisco IOS XE Software. Ge

CVE-2025-20240: Incomplete Blacklist to Cross-Site Scripting in Cisco Cisco IOS XE Software - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-20240: Incomplete Blacklist to Cross-Site Scripting in Cisco Cisco IOS XE Software

Threats Tagged 'cve-2025-20240'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-20240'

Lead Pen Test Professional