Skip to content
Product
Use it
Threat intelligence API
Free key, 70+ endpoints, OpenAPI. The product.
Get started
Pick your stack, make your first call.
Live feed
The console: incidents, filters, entities, search.
Recipes
Runnable examples for the free key.
Free feeds
RSS, ransomware feed, IOC blocklist, MISP — no key.
CLI & agents
tc from a terminal; agent keys with scoped budgets.
The data
Incident records
900 articles a day become ~70 scored incidents.
Dark web
First-party leak-site collection: victims, groups, markets.
Validated IOCs
Indicators with a false-positive gate; STIX, MISP, CSV.
Vulnerabilities
CVEs with EPSS, KEV and exploit status.
Entity graph
Actors, malware, CVEs, companies — pivotable.
For teams
For service providers
Per-client feeds, alerts and branded digests.
Use cases
How teams and builders use the corpus.
About ThreatCluster
What it is and how it is built.
Pricing
Docs
Reference
OpenAPI (Swagger)
Every endpoint, parameter and response model.
ReDoc
The same reference, long-form.
Examples on GitHub
curl, Python and Node quickstarts; daily spec snapshot.
Guides
Quickstart & plans
Key, scopes, budgets, tiers.
Integrations
Splunk, Sentinel, Elastic, agents and terminals, step by step
Export formats
STIX 2.1, MISP, CSV, text.
CLI setup
Install, log in, wire an agent.
No results found
Sign in
Get a free key
No results found
Product
Threat intelligence API
Get started
Live feed
Recipes
Free feeds
CLI & agents
The data
Incident records
Dark web
Validated IOCs
Vulnerabilities
Entity graph
For teams
For service providers
Use cases
About ThreatCluster
Docs
OpenAPI (Swagger)
ReDoc
Examples on GitHub
Quickstart & plans
Integrations
Export formats
CLI setup
Pricing
Contact
Get a free key
Sign in
Back
XSS
Vulnerability
Threat entity extracted from intelligence sources
Oct 18: 1 mention
Oct 19: 1 mention
Oct 20: 1 mention
Oct 21: 1 mention
Oct 22: 1 mention
Oct 23: 1 mention
Oct 24: 1 mention
Oct 18
Oct 21
Oct 24
Entities
›
vulnerability
›
XSS
Frequency
417
occurrences
First Seen
October 29, 2025
Last Seen
October 24, 2026
API
Overview
Recent Events
Profile
Profile
MITRE ATT&CK
1 / 2
Exploited By
APT28
Forest Blizzard
Fancy Bear
Sofacy
WannaCry
Nova
DragonForce
Associated Malware
StealC
Tools Used
Chrome
Nginx
Nmap
Nuclei
VMware
Burp Suite
PowerShell
Google Chrome
Related CVEs
CVE-2025-66376
CVE-2026-42897
CVE-2026-41724
CVE-2026-41723
CVE-2026-41722
CVE-2026-93485
CVE-2026-43512
CVE-2026-43515
MITRE Techniques
T1059.007 - JavaScript
T1190 - Exploit Public-Facing Application
T1059 - Command and Scripting Interpreter
T1203 - Exploitation for Client Execution
T1566 - Phishing
T1041 - Exfiltration Over C2 Channel
T1566.002 - Spearphishing Link
T1505.003 - Web Shell
Affected Platforms
WordPress
Linux
Windows
Electron
Zimbra Collaboration Suite
PHP
Regions
Russia
Ukraine
Germany
Japan
United States
Sectors Affected
Government
Technology
Healthcare
Manufacturing
-
REC
Recon
No techniques detected
-
RD
Resource Dev
No techniques detected
2
IA
Initial Access
T1190 - Exploit Public-Facing Application
T1566 - Phishing
2
EX
Execution
T1059.007 - JavaScript
T1203 - Exploitation for Client Execution
1
PE
Persistence
T1505.003 - Web Shell
1
PE
Priv Esc
T1068 - Exploitation for Privilege Escalation
-
DE
Defense Evasion
No techniques detected
-
CA
Cred Access
No techniques detected
-
DI
Discovery
No techniques detected
-
LM
Lateral Mov
No techniques detected
-
CO
Collection
No techniques detected
1
C2
C2
T1071 - Application Layer Protocol
2
EX
Exfil
T1041 - Exfiltration Over C2 Channel
T1567 - Exfiltration Over Web Service
-
IM
Impact
No techniques detected
10
techniques detected across
6
tactics
Related Clusters (50)
Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign
Jul 23
·
47 sources
81
APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine
Mar 19
·
8 sources
81
Critical XSS Vulnerability in SUSE Rancher Exposes Admin Sessions
Sep 30
·
1 sources
80
Russian Hackers Exploit Zimbra Zero-Day for Email Theft
Jul 10
·
10 sources
79
Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks
Jun 18
·
0 sources
79
CVE-2026-55879: Critical XSS Vulnerability in OpenReplay Leads to Account Takeover
Jul 11
·
1 sources
78
Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution
Jun 25
·
2 sources
78
Critical Stored XSS Vulnerabilities Found in SiYuan Versions Before 3.7.4
Aug 16
·
3 sources
78
Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks
Jun 26
·
2 sources
78
Russian APT Exploits Zimbra XSS to Target Ukrainian Government
Mar 20
·
4 sources
78
Multiple WordPress Plugins Face Vulnerabilities Requiring Immediate Updates
Oct 1
·
0 sources
75
Twitch Chat Messages Exploit OBS Studio via Chromium Vulnerability
Sep 25
·
3 sources
75
Ivanti EPM Vulnerability Allows Remote Code Execution
Dec 10
·
2 sources
75
Critical XSS Vulnerability in Chamilo LMS Leads to Admin Account Takeover
Jul 21
·
2 sources
74
Critical XSS and Code Execution Vulnerabilities in Fedora Prometheus Update
Jul 11
·
2 sources
74
SAP Addresses Critical Vulnerabilities in July 2026 Security Updates
Jul 14
·
7 sources
74
Critical XSS and Memory Vulnerabilities in Oracle PHP Releases
Jul 6
·
2 sources
74
Microsoft's Record Patch Tuesday in June 2026 Addresses 206 Vulnerabilities
Jul 1
·
132 sources
74
Critical Vulnerabilities in Umbraco CMS and Linux Kernel Exploited
Sep 26
·
4 sources
74
Microsoft Patches Critical Exchange Server Zero-Day Vulnerability CVE-2026-42897
Jun 11
·
15 sources
74
Multiple CVEs Disclosed on September 8, 2026, Affecting Microsoft Products
Sep 8
·
927 sources
74
July 2026 Security Update: Record CVEs and Critical Vulnerabilities
Jul 14
·
2 sources
74
High-Severity Stored XSS Vulnerability in HAX CMS (CVE-2026-48527)
May 29
·
1 sources
74
Critical SQL Injection and XSS Vulnerabilities in RoundcubeMail Affect Fedora Users
Jun 4
·
2 sources
74
Critical WordPress XSS2Shell Flaw Enables Admin Takeover and RCE
Aug 11
·
3 sources
73
Critical Vulnerabilities and Exploits Targeting Cisco, Canvas, and Microsoft Systems
May 15
·
2 sources
73
Critical XSS Vulnerability in Lukevella Rally Affects Versions Up to 4.7.4
Apr 18
·
0 sources
73
Critical Apache ActiveMQ Vulnerability Enables Security Header Injection Attacks
Jun 3
·
2 sources
73
Critical Webmin Vulnerabilities Enable User Impersonation and Root Access
Jun 24
·
2 sources
73
Critical RCE Vulnerability in SiYuan Bazaar Exposes Users to Malicious Packages
Jun 22
·
2 sources
73
Critical XSS Vulnerability in Coturn Affects Fedora 43 and 44
Jun 24
·
2 sources
73
Critical Authentication Bypass Vulnerability in Spring Authorization Server
Jul 18
·
1 sources
73
Critical justhtml Sanitization Bypass Vulnerabilities Discovered
Aug 23
·
5 sources
73
Critical SPIP Vulnerabilities Discovered in Ubuntu 16.04 LTS
Apr 6
·
2 sources
73
Critical GitLab Vulnerabilities Enable XSS and DoS Attacks
May 14
·
3 sources
72
High-Severity SQL Injection Vulnerability in OpenEMR (CVE-2026-33917)
Mar 26
·
2 sources
72
Critical Vulnerabilities Found in Ruby on Rails ViewComponent Framework
Jul 18
·
2 sources
72
Zimbra 10.1.20 Patches Critical SNMP Command Injection Vulnerability
Jul 21
·
4 sources
72
Denial of Service Vulnerabilities in Nextcloud Affecting Fedora Users
Sep 28
·
3 sources
72
Multiple Vulnerabilities Discovered in kerwincui FastBee Software
May 3
·
2 sources
72
Okta Patches Critical Vulnerabilities Enabling XSS, Auth Bypass, and SQL Injection
Sep 11
·
3 sources
72
Rocky Linux 8 Faces Critical Vulnerabilities in xmlrpc-c and Redis
Sep 9
·
3 sources
72
Critical XSS Vulnerability in Pretalx Conference Platform Exposed
May 28
·
3 sources
72
OpenWrt Releases Critical Security Updates for DHCPv6 Vulnerabilities
Jul 29
·
2 sources
72
Multiple Vulnerabilities in Microsoft Office Excel (CVE-2026)
Mar 10
·
14 sources
72
Critical Vulnerabilities in Delinea Secret Server Expose Sensitive Credentials
Sep 16
·
2 sources
72
Critical Vulnerabilities in React and Next.js Require Immediate Updates
May 8
·
5 sources
72
Zero-Day Vulnerability in VS Code Allows GitHub Token Theft via Malicious Links
Jun 3
·
12 sources
71
Critical MapLibre GL JS Vulnerability Exposes Millions to Zero-Click Attacks
Sep 9
·
2 sources
71
Critical XSS Vulnerability in Roundcube Webmail Discovered
Jun 30
·
2 sources
71
Prev
1 / 10
Next
Related Articles (50)
SecurityAffairs
securityaffairs.co
·
1h ago
Cómo cerrar la brecha de 32 días que separa el parche del exploit en 10 horas
Ciberseguridadlatam
·
1d ago
Discord RCE
blog.electrovolt.io
·
2d ago
Php2shell Leaked Critical Php Rce Cve 2026 109618 Cve 2026 109619
hadrian.io
·
3d ago
Advisories
github.com
·
4d ago
CVE Alert: CVE-2026-3295 – IBM
Redpacketsecurity
·
5d ago
Advisories
github.com
·
6d ago
Mage-OS 3.6.0 – Security Release
mage-os.org
·
Oct 17
Pfsense Ce Leftovers
abraxaslabs.tech
·
Oct 16
More Critical Bugs In Adobe Experience Manager Pre Auth Rce
www.slcyber.io
·
Oct 15
CVE 2026 0316
security.paloaltonetworks.com
·
Oct 15
Black Duck OSSRA announcement
news.blackduck.com
·
Oct 14
CVE Alert: CVE-2026-109291 – open-webui – open
Redpacketsecurity
·
Oct 13
GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8
Daily.Dev
·
Oct 12
Stored Xss Hortusfox Via Plant Attachment
hackmd.io
·
Oct 9
CVE Alert: CVE-2026-108101 – danielbrendel – hortusfox
Redpacketsecurity
·
Oct 9
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on ...
Cisa
·
Oct 8
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
Securityaffairs
·
Oct 7
HTTP Guides CSP
developer.mozilla.org
·
Oct 7
HACKERS EXPLOIT NINJA FORMS AND WPC PRODUCT BUNDLES XSS FLAWS TO ...
X
·
Oct 7
KB4934: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4
Veeam
·
Oct 6
Ninja Forms plugin flaw exploited to hack WordPress sites
Bleepingcomputer
·
Oct 6
Wwbn Avideo 12.4 Through 29.2.0 Stored Xss Via Double Encoded Video Title
www.vulncheck.com
·
Oct 4
Wcms Issues 662
github.com
·
Oct 4
Ids 2017
www.unb.ca
·
Oct 3
Kiteworks patches max severity code injection vulnerability
Bleepingcomputer
·
Oct 1
Wordpress Givewp Plugin 4 16 9 Cross Site Scripting Xss Vulnerability
patchstack.com
·
Sep 30
Threat Radar
radar.offseq.com
·
Sep 30
OpenAI's AI agents exploited a Google security education game to scrape UN trade data
The-Decoder
·
Sep 28
OpenAI agents went the long way round for UN data
Theregister
·
Sep 28
CVE-2022
Sploitus
·
Sep 28
CVE-2022
Sploitus
·
Sep 28
Fedora 44 Nextcloud 34.0.4 Denial of Service XSS Advisories 2026
Linuxsecurity
·
Sep 28
Fedora 45 Nextcloud 34.0.4 Denial of Service and XSS Issues 2026
Linuxsecurity
·
Sep 28
CVE-2020-9471 : faille élevée umbraco umbraco cms (CVSS 8.8)
Forenshield
·
Sep 27
Security Bulletin node/7288641
www.ibm.com
·
Sep 25
Malicious Twitch chat messages can trigger code execution on OBS Studio
Cyberinsider
·
Sep 25
CVE-2024
Sploitus
·
Sep 24
Exploit for Cross-site Scripting in Xerox Centreware_Web
Sploitus
·
Sep 23
CVE-2017-20192-formidable
Sploitus
·
Sep 23
CVE-2026-94426 - Low Vulnerability
Thehackerwire
·
Sep 22
"moderation isn't a security control."
patchstack.com
·
Sep 22
Comment2shell Zero Click Pre Auth Xss To Rce In Wordpress Core
idnsec.com
·
Sep 22
WordPress Comment2Shell Flaw Turns Comments Into RCE
Cyberkendra
·
Sep 22
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Thehackernews
·
Sep 22
CVE-2020
Sploitus
·
Sep 22
awesome-mobile
Sploitus
·
Sep 21
awesome-android
Sploitus
·
Sep 21
Siyuan Through 3.8.4 Stored Xss Via Notebook Names
www.vulncheck.com
·
Sep 19
Siyuan Through 3.8.4 Stored Xss Via Heading Style Attribute
www.vulncheck.com
·
Sep 19
Prev
1 / 10
Next
Related Entities
APT28
Forest Blizzard
Fancy Bear
Sofacy
Sql Injection
DDoS
Data Breach
Cross-site Scripting
Zero-day Exploit
Phishing
Denial of Service
Malware
,p_Ii9kYXRhYmFzZS93b3JkcHJlc3MvcGx1Z2luL3NpdGVza2l0ZS92dWxuZXJhYmlsaXR5L3dvcmRwcmVzcy1zaXRlc2tpdGUtcGx1Z2luLTItMS04LXJlbW90ZS1jb2RlLWV4ZWN1dGlvbi1yY2UtdnVsbmVyYWJpbGl0eSI,s__DbMe5dVBwz8g5hf.png)
,p_Ii9kYXRhYmFzZS93b3JkcHJlc3MvcGx1Z2luL2dpdmUvdnVsbmVyYWJpbGl0eS93b3JkcHJlc3MtZ2l2ZXdwLXBsdWdpbi00LTE2LTktY3Jvc3Mtc2l0ZS1zY3JpcHRpbmcteHNzLXZ1bG5lcmFiaWxpdHki,s_AMhWcmUB27MBUYs2.png)
