Everyone's on the cyber target list

Welcome to this week's edition of the Threat Source newsletter. I've discovered that being a rent guarantor for someone is an involved experience. While I'm glad that I can help out a loved one secure a better rental property, the process of verifying my identity and ability to cover any missed...

libvpx: Double-free in libvpx encoder

A flaw was found in libvpx. A double-free issue can occur in vpxcodecencinitmulti after a failed allocation when initializing the encoder for WebRTC. This can cause memory corruption and an exploitable crash...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

CVE-2025-5382

CVE-2025-5382 concerns Devolutions Server (versions ≤ 2025.1.7.0) where improper access control in the user MFA feature lets a user with the user-management permission remove or change administrators’ MFA settings. The vulnerability affects the MFA configuration component and is triggered by insu...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

libvpx: Double-free in libvpx encoder

A flaw was found in libvpx. A double-free issue can occur in vpxcodecencinitmulti after a failed allocation when initializing the encoder for WebRTC. This can cause memory corruption and an exploitable crash...

PT-2025-23931 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.7.0 and earlier Description: The issue is related to inadequate access control in the Multi-Factor Authentication MFA feature for users in Devolutions Server. This allows a user with user management permissi...

Authenticated Private Set Intersection: a Merkle Tree-Based Approach for Enhancing Data Integrity

Private Set Intersection PSI enables secure computation of set intersections while preserving participant privacy, standard PSI existing protocols remain vulnerable to data integrity attacks allowing malicious participants to extract additional intersection information or mislead other parties. I...

StealthInk: a Multi-Bit and Stealthy Watermark for Large Language Models

Watermarking for large language models LLMs offers a promising approach to identifying AI-generated text. Existing approaches, however, either compromise the distribution of original generated text by LLMs or are limited to embedding zero-bit information that only allows for watermark detection b...

Binary Vulnerability in Unisys UOS Desktop Professional Edition by Unisys Software Technology Co.

Unisys UOS Desktop Professional Edition is a commercial desktop operating system based on Linux kernel, which supports all CPU architectures including AMD64, ARM64, LoongArch64, SW64 and other mainstream architectures, and is suitable for domestic CPU platforms e.g., Haikuang, Zhaoshen, etc.. The...

Devolutions Server 访问控制错误漏洞

Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2025.1.7.0 and prior versions that stems from improper access control of the user MFA...

Comprehensive Vulnerability Analysis Is Necessary for Trustworthy LLM-MAS

This paper argues that a comprehensive vulnerability analysis is essential for building trustworthy Large Language Model-based Multi-Agent Systems LLM-MAS. These systems, which consist of multiple LLM-powered agents working collaboratively, are increasingly deployed in high-stakes applications bu...

para 日志信息泄露漏洞

para is a multi-tenant backend server open-sourced by Erudika for rapidly building web and mobile applications. A log information disclosure vulnerability exists in versions prior to para 1.50.8, which stems from explicit logging of access tokens in the logs, which could lead to token disclosure...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.14.18 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.15.14 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

CVE-2024-1440

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By...

Rapid7 Q1 2025 Incident Response Findings

Rapid7’s Q1 2025 incident response data highlights several key initial access vector IAV trends, shares salient examples of incidents investigated by the Rapid7 Incident Response IR team, and digs into threat data by industry as well as some of the more commonly seen pieces of malware appearing i...

CVE-2025-3951

The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations...