MAD-Spear: a Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems

Multi-agent debate MAD systems leverage collaborative interactions among large language models LLMs agents to improve reasoning capabilities. While recent studies have focused on increasing the accuracy and scalability of MAD systems, their security vulnerabilities have received limited attention...

CVE-2025-31422

Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through = 2.4...

The vulnerability of Siemens Solid Edge’s design and simulation tools relates to reading beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Siemens Solid Edge’s design and simulation tools is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created .par file...

Dassault Systèmes SOLIDWORKS eDrawings 安全漏洞

Dassault Systèmes SOLIDWORKS eDrawings is a collaboration tool for viewing, sharing, and labeling 2D/3D design files from Dassault Systèmes, France. A security vulnerability exists in Dassault Systèmes SOLIDWORKS eDrawings, which originates from the presence of uninitialized variables during the...

The vulnerability of the CADImage plugin in the IrfanView software, which is used for viewing and playing graphic, video, and audio files, allows a hacker to execute arbitrary code.

The vulnerability of the CADImage plugin for viewing and playing back graphic, video, and audio files in IrfanView arises from the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially...

CVE-2025-46334

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

Never Trust the Manufacturer, Never Trust the Client: a Novel Method for Streaming STL Files for Secure Additive Manufacturing

While additive manufacturing has opened interesting avenues to reimagine manufacturing as a service MaaS platform, transmission of design files from client to manufacturer over networks opens up many cybersecurity challenges. Securing client's intellectual property IP especially from cyber-attack...

CVE-2025-46334 Git GUI malicious command injection on Windows

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

CVE-2025-46334

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

CVE-2025-46334

Git GUI on Windows is affected by CVE-2025-46334. A malicious repository can ship a harmful sh.exe or textconv filter (e.g., astextplain) due to Tcl’s Windows search path including the current directory, causing these programs to run when a user selects Git Bash or Browse Files. This is a local v...

Hedge Funds on a Swamp: Analyzing Patterns, Vulnerabilities, and Defense Measures in Blockchain Bridges [Experiment, Analysis and Benchmark]

Blockchain bridges have become essential infrastructure for enabling interoperability across different blockchain networks, with more than $24B monthly bridge transaction volume. However, their growing adoption has been accompanied by a disproportionate rise in security breaches, making them the...

CVE-2025-6377

A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threa...

Clio-X: AWeb3 Solution for Privacy-Preserving AI Access to Digital Archives

As archives turn to artificial intelligence to manage growing volumes of digital records, privacy risks inherent in current AI data practices raise critical concerns about data sovereignty and ethical accountability. This paper explores how privacy-enhancing technologies PETs and Web3 architectur...

Rockwell Automation Arena 安全漏洞

Rockwell Automation Arena is a discrete-event simulation software developed by Rockwell Automation for a wide range of manufacturing, logistics, and service industries. A code execution vulnerability exists in Rockwell Automation Arena, which is caused by out-of-bounds writes to specially crafted...

LDP$^3$: an Extensible and Multi-Threaded Toolkit for Local Differential Privacy Protocols and Post-Processing Methods

Local differential privacy LDP has become a prominent notion for privacy-preserving data collection. While numerous LDP protocols and post-processing PP methods have been developed, selecting an optimal combination under different privacy budgets and datasets remains a challenge. Moreover, the la...

Automated Reasoning for Vulnerability Management by Design

For securing systems, it is essential to manage their vulnerability posture and design appropriate security controls. Vulnerability management allows to proactively address vulnerabilities by incorporating pertinent security controls into systems designs. Current vulnerability management approach...

Post-Processing in Local Differential Privacy: an Extensive Evaluation and Benchmark Platform

Local differential privacy LDP has recently gained prominence as a powerful paradigm for collecting and analyzing sensitive data from users' devices. However, the inherent perturbation added by LDP protocols reduces the utility of the collected data. To mitigate this issue, several post-processin...

Malicious code in @laredoute/design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e56fdae15fb0b525a4212e71ff9dd4ec7cd0e3f4076552ec379c49c8f4a4e899 The OpenSSF Package Analysis project identified '@laredoute/design-tokens' @ 0.1.55 npm as malicious. It is considered malicious because: - The...

Manufacturing Security: Why Default Passwords Must Go

If you didn't hear about Iranian hackers breaching US water facilities, it's because they only managed to control a single pressure station serving 7,000 people. What made this attack noteworthy wasn't its scale, but how easily the hackers gained access — by simply using the manufacturer's defaul...

BackFed: an Efficient and Standardized Benchmark Suite for Backdoor Attacks in Federated Learning

Federated Learning FL systems are vulnerable to backdoor attacks, where adversaries train their local models on poisoned data and submit poisoned model updates to compromise the global model. Despite numerous proposed attacks and defenses, divergent experimental settings, implementation errors, a...