Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

CVE-2025-5806 is a high-severity cross-site scripting (XSS) vulnerability found in the Jenkins Gatling Plugin version 136.vb_9009b_3d33a_e. This plugin is used within Jenkins, a widely adopted open-source automation server for continuous integration and continuous delivery (CI/CD). The vulnerability arises because the plugin serves Gatling performance test reports in a way that bypasses the Content-Security-Policy (CSP) protections introduced in Jenkins versions 1.641 and 1.625. CSP is a security mechanism designed to prevent certain types of attacks, including XSS, by restricting the sources from which content can be loaded. By circumventing this protection, the plugin allows maliciously crafted report content to execute arbitrary JavaScript in the context of the Jenkins web interface. Exploitation requires that an attacker has privileges to modify or upload Gatling reports, which implies at least limited authenticated access (PR:L). The attack vector is network-based (AV:N), meaning it can be exploited remotely over the network. User interaction is required (UI:R), typically involving a user viewing the malicious report. The impact is severe, affecting confidentiality, integrity, and availability (C:H/I:H/A:H), as arbitrary script execution can lead to credential theft, session hijacking, unauthorized actions within Jenkins, or disruption of CI/CD pipelines. Although no known exploits are currently reported in the wild, the vulnerability's characteristics and high CVSS score (8.0) indicate a significant risk to Jenkins environments using the affected plugin version. The vulnerability is classified under CWE-79, which covers improper neutralization of input leading to XSS attacks.

Detailed information about CVE-2025-5806: Vulnerability in Jenkins Project Jenkins Gatling Plugin affecting Jenkins Project Jenkins Gatling Plugin. Get real-tim

CVE-2025-5806: Vulnerability in Jenkins Project Jenkins Gatling Plugin - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-5806: Vulnerability in Jenkins Project Jenkins Gatling Plugin

Threats Tagged 'cve-2025-5806'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-5806'

Lead Pen Test Professional