Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22

CVE-2026-42151 is a security vulnerability impacting the keda-fips package and Red Hat Hardened Images RPMs, including components such as jaeger and opentelemetry-collector. The vulnerability is one of eight addressed in the keda-fips 2.19.0-r2 release and related Red Hat RPM updates. The advisories from Red Hat confirm that updated RPM packages (e.g., jaeger-2.19.0-1.hum1, opentelemetry-collector-0.153.0-1.hum1) include fixes for this CVE. The vulnerability is associated with CWEs 256 (Plaintext Storage of a Password) and 770 (Allocation of Resources Without Limits or Throttling). The vendor has issued official security advisories and patches to mitigate the risk.

Detailed information about Prometheus Azure AD remote write OAuth client secret exposed via config API affecting Microsoft Security Response Center Microsoft. G

Prometheus Azure AD remote write OAuth client secret exposed via config API - Live Threat Intelligence - Threat Radar | OffSeq.com

https://images.redhat.com/

https://access.redhat.com/security/cve/CVE-2026-42154

https://access.redhat.com/security/updates/classification/

Canonical URL

https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4

https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index

https://access.redhat.com/errata/RHSA-2026:40970

https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index

https://access.redhat.com/errata/RHSA-2026:50874

Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release

prometheus

A stored cross-site scripting (XSS) vulnerability exists in the legacy Prometheus web UI's histogram heatmap chart view. This occurs because label values for histogram buckets are not properly escaped when rendered as axis tick marks in HTML. An attacker able to inject crafted metrics can execute arbitrary JavaScript in the browsers of users viewing the affected heatmap UI. The vulnerability affects multiple Prometheus versions prior to 3.5.3 and 3.11.3 where the legacy UI is enabled. Fixed versions 3.5.3 and 3.11.3 address this issue.

In Prometheus versions from 2.49.0 up to but not including 3.5.3, and from 3.6.0 up to but not including 3.11.3, the legacy web UI (enabled via --enable-feature=old-ui) contains a stored XSS vulnerability in the histogram heatmap chart. The vulnerability arises because the bucket label values are inserted into the HTML for axis tick marks without proper escaping, allowing injected JavaScript to execute in the context of any user viewing the heatmap chart. This flaw is fixed in versions 3.5.3 and 3.11.3.

Detailed information about BIT-prometheus-2026-44903: Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometh

BIT-prometheus-2026-44903: Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI - Live Threat Intelligence - Threat Radar | OffSeq.com

From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the… (CVE-2026-44903)


Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer ReleaseCVE-2026-42151 0 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22 HighVulnerability#gcve #csaf #cve-2026-42151 Join the discussion	GCVE Database	08/05/2026, 17:56:26 UTC Added: 06/03/2026, 21:10:07 UTC
From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the… (CVE-2026-44903)CVE-2026-44903 0 A stored cross-site scripting (XSS) vulnerability exists in the legacy Prometheus web UI's histogram heatmap chart view. This occurs because label values for histogram buckets are not properly escaped when rendered as axis tick marks in HTML. An attacker able to inject crafted metrics can execute arbitrary JavaScript in the browsers of users viewing the affected heatmap UI. The vulnerability affects multiple Prometheus versions prior to 3.5.3 and 3.11.3 where the legacy UI is enabled. Fixed versions 3.5.3 and 3.11.3 address this issue. MediumVulnerability#gcve #osv #bit-prometheus-2026-44903 Join the discussion	GCVE Database	05/26/2026, 22:16:00 UTC Added: 07/15/2026, 12:36:32 UTC

Threats Tagged 'cve-2026-44903'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-44903'

Lead Pen Test Professional