CVE-2026-13461

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

CVE-2026-13462

The PayRange Android app (version 7.0.7 and below ) contains an SSL bypass vulnerability in its application webviews. The flaw allows the app to bypass Android's SSL trust chain by accepting invalid certificates that match specific rules, such as Common Names ending with "payrange.com", containin...

EUVD-2026-42637

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

CVE-2026-13462 PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

CVE-2026-13461

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

EUVD-2026-42635

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

PYSEC-2026-2888 Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

CVE-2026-59207

creationtimestamp| type| source ---|---|--- 2026-07-09 16:10:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7zibfybn25...

CVE-2026-59208

creationtimestamp| type| source ---|---|--- 2026-07-09 16:03:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7z3sn6kq2i 2026-07-15 15:22:07+00:00| seen| https://bsky.app/profile/hn100.bsky.social/post/3mqozlgli3q2t 2026-07-15 15:27:26+00:00| seen|...

CVE-2017-2845

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7k7ms5iz2n...

CVE-2026-2342

creationtimestamp| type| source ---|---|--- 2026-07-09 09:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7dvjy7wm2w...

CVE-2026-15137

creationtimestamp| type| source ---|---|--- 2026-07-09 03:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qa72g7o2k...

CVE-2026-15112

creationtimestamp| type| source ---|---|--- 2026-07-09 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116887429378642543 2026-07-09 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq6icwy3iv23 2026-07-09 04:45:15+00:00| seen|...

EUVD-2026-42486

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

The vulnerability of the UPnP_AV_Server_Path_Del function in the /cgi-bin/app_mgr.cgi microprogramming system of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the UPnPAVServerPathDel function in the /cgi-bin/appmgr.cgi microprogramming system of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4,...

CVE-2026-59855: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an...

CVE-2026-13462: Undefined Security Weakness

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

PT-2026-56834

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

Malicious code in testis-pack (npm)

The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...