OESA-2025-1845 git security update

Security Fixes: A vulnerability was found in Microsoft Visual Studio Programming Tool Software affected version not known. It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A...

CVE-2025-7784

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin PermissionsFGAPv2 are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorize...

CVE-2025-53964

A flaw was found in GoldenDict. The application allows reading and modification of arbitrary files when a user adds a specially crafted dictionary and subsequently performs a search. This vulnerability allows a network attacker with user interaction to potentially manipulate files on the system...

The CryptoNeo Threat Modelling Framework (CNTMF): Securing Neobanks and Fintech in Integrated Blockchain Ecosystems

The rapid integration of blockchain, cryptocurrency, and Web3 technologies into digital banks and fintech operations has created an integrated environment blending traditional financial systems with decentralised elements. This paper introduces the CryptoNeo Threat Modelling Framework CNTMF, a...

VulnCheck KEV: CVE-2025-53770

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this...

CVE-2025-53817

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue. Mitigation Mitigation for this issue i...

CVE-2025-53816

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue. Mitigation Mitigation for this issue is either not...

CVE-2025-53644

A heap buffer write flaw was found in OpenCV. This vulnerability could result in arbitrary memory overwrites and code execution within the context of a program using OpenCV. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2025-7339

A header modification flaw has been discovered in the on-headers npm library. In specific cases, response headers may be inadvertently modified when an array is passed to response.writeHead. Mitigation Users may work around this issue by passing an object rather than an array to the...

CVE-2025-7338

A denial of service vulnerability was found in the Multer NPM library. This vulnerability allows an attacker to trigger a denial of service DoS by sending a malformed multi-part upload request. This request causes an unhandled exception, resulting in a process crash. Mitigation Mitigation for thi...

CVE-2025-40924

A session id generation flaw has been discovered in the Catalyst::Plugin::Session Perl module. The session id is generated from a hash usually SHA-1 of a simple counter, the epoch time, the built-in rand function, the PID, and the current Catalyst context. This information is of low entropy. The...

CVE-2025-7738

A flaw was found in Ansible Automation Platform AAP where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users...

CVE-2025-27465

A flaw was found in Xen. Xen’s emulation of intercepted instructions uses replay mechanisms with executable stubs. Improper handling of exceptions raised during this replay process allows a local attacker to trigger unexpected behavior. This issue can occur when an instruction causes an exception...

CVE-2025-22227

A flaw was found in io.projectreactor.netty/reactor-netty. Reactor Netty’s HTTP client, when explicitly configured to follow redirects in chained redirect scenarios, can inadvertently leak credentials. This flaw allows an attacker to trigger this credential leakage by manipulating the redirect...

Prompt Injection 2.0: Hybrid AI Threats

Prompt injection attacks, where malicious input is designed to manipulate AI systems into ignoring their original instructions and following unauthorized commands instead, were first discovered by Preamble, Inc. in May 2022 and responsibly disclosed to OpenAI. Over the last three years, these...

Exploiting Jailbreaking Vulnerabilities in Generative AI to Bypass Ethical Safeguards for Facilitating Phishing Attacks

The advent of advanced Generative AI GenAI models such as DeepSeek and ChatGPT has significantly reshaped the cybersecurity landscape, introducing both promising opportunities and critical risks. This study investigates how GenAI powered chatbot services can be exploited via jailbreaking techniqu...

Exploit for CVE-2025-22870

CVE-2025-22870 – Proxy Bypass via IPv6 Zone Parsing in Go 🔐...

CVE-2025-40777

An assertion failure flaw has been discovered in bind. If a named caching resolver is configured with serve-stale-enable: yes, and with stale-answer-client-timeout set to 0, and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cach...

CVE-2025-40918

A client nonce cnonce generation flaw has been discovered in Authen::SASL::Perl::DIGESTMD5. The cnonce is generated from an MD5 hash of the PID, the epoch time, and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed if it is not leaked fro...

CVE-2025-40919

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...