Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

CVE-2025-21612 is a high-severity cross-site scripting (XSS) vulnerability affecting the TabberNeue extension for MediaWiki, specifically versions from 1.9.1 up to but not including 2.7.2. TabberNeue is used to create tabbed interfaces within MediaWiki pages. The vulnerability arises from improper neutralization of user-supplied input in the TabberTransclude.php file, where the page name parameter is not properly escaped before being output in the generated web page. This allows an attacker to inject malicious scripts via crafted page names, which are then executed in the context of users viewing the affected wiki pages. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags). The CVSS v3.1 base score is 8.6, indicating a high severity, with an attack vector of network (remote exploitation), low attack complexity, no privileges required, and no user interaction needed. Successful exploitation can lead to significant confidentiality impact by stealing session cookies or other sensitive data, limited integrity impact, and availability impact through potential browser crashes or denial of service. The issue was fixed in version 2.7.2 of the extension. No known exploits are currently reported in the wild, but the vulnerability is publicly disclosed and thus poses a risk to unpatched systems. Given the nature of MediaWiki deployments, this vulnerability can be exploited by unauthenticated remote attackers simply by convincing users to visit a maliciously crafted wiki page or link.

Detailed information about CVE-2025-21612: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools medi

CVE-2025-21612: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools mediawiki-extensions-TabberNeue - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-21612: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools mediawiki-extensions-TabberNeue

Threats Tagged 'cve-2025-21612'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-21612'

Lead Pen Test Professional