Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.

That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.

CVE-2025-40916 identifies a cryptographic weakness in the GRYPHON Mojolicious::Plugin::CaptchaPNG version 1.05, a Perl plugin used to generate CAPTCHA images. The vulnerability arises from the use of Perl's built-in rand() function as the source of randomness for both the CAPTCHA text and the image noise. The rand() function is a pseudo-random number generator (PRNG) that is not designed for cryptographic purposes and is considered weak because it produces predictable sequences if the internal state or seed can be inferred. This weakness falls under CWE-338, which concerns the use of cryptographically weak PRNGs. The insecure randomness undermines the security of the CAPTCHA mechanism, potentially allowing attackers to predict or reproduce CAPTCHA challenges, thereby bypassing the CAPTCHA protection. This can facilitate automated attacks such as credential stuffing, brute force login attempts, or spam submissions on web applications relying on this plugin. No known exploits have been reported in the wild as of the publication date (June 16, 2025), and no official patch or mitigation has been released yet. The vulnerability is specific to version 1.05 of the plugin and does not affect other versions unless they use the same weak random source. Since CAPTCHA is a common defense mechanism against automated abuse, the weakness in randomness directly impacts the integrity and effectiveness of this security control.

Detailed information about CVE-2025-40916: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator in GRYPHON Mojolicious::Plugin::CaptchaPNG affec

CVE-2025-40916: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator in GRYPHON Mojolicious::Plugin::CaptchaPNG - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40916: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator in GRYPHON Mojolicious::Plugin::CaptchaPNG

Threats Tagged 'cve-2025-40916'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-40916'

Lead Pen Test Professional