This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.
Kirki plugin for WordPress versions before 6.4.1 has a broken object-level access control vulnerability in its REST API. This flaw allows users with the Editor role, who have Kirki edit access, to modify the title, slug, and publication status of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the plugin relies only on a coarse role-based check without verifying per-object WordPress capabilities. This can lead to unauthorized exposure or removal of content.
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
A stack-based buffer overflow vulnerability exists in the GIMP PSD plug-in's image resource header loader. This flaw occurs due to an incorrect destination size used when copying a converted resource name into a fixed stack buffer. Opening a specially crafted PSD file can trigger this overflow, potentially causing a crash or arbitrary code execution in the context of the user running GIMP. Exploitation requires user interaction to open or parse a malicious PSD file. Mitigations include avoiding untrusted PSD files and removing the GIMP package if not needed.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials.
This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.
The FBI seized the domain virtualine.net, used by Virtualine, a Russian-speaking bulletproof hosting provider that supported various cybercriminal activities including hack-for-hire services, ransomware, infostealers, phishing, spam, and carding. Despite law enforcement takedown requests, Virtualine continued aiding illicit customers and hosting illegal content. The provider received significant cryptocurrency payments linked to criminal operations such as drug marketplaces, sextortion schemes, and ransomware groups. Domain seizure disrupts access but does not guarantee cessation of the operator's activities or loss of infrastructure access.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery.
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.
Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.
If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.
Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
Proof of concept: https://beford.net/poc/ssl_poc.html
Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.
tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs.
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.