Threat actors thrive in chaos

Welcome to this week's edition of the Threat Source newsletter. If there's one thing that threat actors love, it's chaos. Headlines in the news that provoke an emotional response make excellent phishing lures because the intense feelings invoked by a provocative subject line cause our critical...

CVE-2025-31475

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code ...

The vulnerability of the Wayland protocol for X.Org XWayland, which is a implementation of the X Window System X.Org Server, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Wayland protocol for X.Org XWayland, which is implemented by the X.Org Server, relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the enic_main.c component in the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the enicmain.c component in the Linux operating system is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to writing beyond the buffer limit, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the calloc function in the RESP Handler component of clients for interacting with HIREDIS databases allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the calloc function in the RESP Handler component of clients for interacting with the HIREDIS database is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to reading data beyond the allowed buffer limits, allows attackers to cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to reading data beyond the acceptable buffer limits. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to reading data beyond the allowed buffer limits, allows attackers to cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to reading data beyond the allowed buffer limits, allows attackers to cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to reading data beyond the acceptable buffer limits. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the light.c component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the light.c component in the Linux operating system’s kernel is related to improper control of resource identifiers. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the driver/driver/usb/musb/musb_gadget.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/usb/musb/musbgadget.c component of the Linux operating system is related to insufficient blocking mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ocelot_ifh_set_basic() function in the ocelot.c component of the Linux operating system’s kernel allows a hacker to induce a service failure.

The vulnerability of the ocelotifhsetbasic function in the ocelot.c component of the Linux operating system’s kernel is related to insufficient neutralization of certain elements in the request. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the sound/pci/hda/hda_cs_dsp_ctl.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the sound/pci/hda/hdacsdspctl.c component in the Linux operating system is related to pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ass_outline_construct() function in the ASS/SSA Libass subtitle renderer allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the assoutlineconstruct function in the ASS/SSA Libass subtitle renderer is related to integer overflow. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the AC3 File Handler component in the streaming multimedia processing library of Live555 allows a attacker to cause a service failure.

The vulnerability of the AC3 File Handler component in the Live555 multimedia streaming library is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

The vulnerability of the MP3 Stream Handler component in the Live555 multimedia streaming library allows a attacker to cause a service failure.

The vulnerability of the MP3 Stream Handler component in the Live555 multimedia streaming library lies in its ability to read data from buffers beyond acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the gf_opus_read_length function, found in the media_tools/av_parsers.c file of the MP4Box encoder for the GPAC multimedia platform, allows a hacker to cause a service failure.

The vulnerability of the gfopusreadlength function, found in the mediatools/avparsers.c file of the MP4Box encoder for the GPAC multimedia platform, is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `gf_opus_parse_packet_header` function in the `media_tools/av_parsers.c` file, implemented by the MP4Box packaging tool for the GPAC multimedia platform, allows a hacker to cause a service failure.

The vulnerability of the gfopusparsepacketheader function in the mediatools/avparsers.c file, belonging to the MP4Box packaging tool of the GPAC multimedia platform, is related to the lack of checks for division by zero. Exploiting this vulnerability could allow a remote attacker to cause service...

The vulnerability of the NFSD component in the Linux operating system’s kernel allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the NFSD component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the formSetPPTPServer() function in the Tenda AC7 router’s microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetPPTPServer function in the Tenda AC7 router’s microprogramming software is related to the operation of writing data outside of the buffer in memory when processing the pptpserverstartip and pptpserverendip parameters. Exploiting this vulnerability allows a remote...