@haxtheweb/app-editor-hax (>=9.0.0-alpha.0, <=9.0.1), @haxtheweb/app-hax (>=9.0.19, <=25.0.0) +33 more potentially affected by CVE-2026-46396 via @haxtheweb/iframe-loader (>=9.0.22, <=25.0.0)

@haxtheweb/iframe-loader NPM version =9.0.22, =9.0.0-alpha.0, =9.0.19, =9.0.0-alpha.0, =9.0.19, =9.0.25, =9.0.20, =9.0.22, =9.0.22, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.9, =0.0.0, =9.0.19, =9.0.0-alpha.0, =25.0.0 and more Source cves: CVE-2026-46396 Source advisory:...

CVE-2026-10580 Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::getuserpermissions, which returns the same null sentinel f...

CVE-2026-10580 Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::getuserpermissions, which returns the same null sentinel f...

CVE-2026-10580

The CVE-2026-10580 entry describes an Authentication Bypass vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to 1.9.4). A logic conflation in HippooPermissions::get_user_permissions() makes administrators and unauthenticated visitors share a null sentinel, whic...

Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps

Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin , according to findings from ESET. The Slovakian cybersecurity company said it first detected the malware spread via multiple campaigns in early 2025, with each attack wave making use of distinct websites...

EUVD-2026-34803

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability...

CVE-2026-49777

creationtimestamp| type| source ---|---|--- 2026-06-05 10:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnjuxxgeko2l 2026-06-05 10:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnjuxxgeko2l 2026-06-05 11:25:00+00:00| seen|...

EUVD-2026-34472

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

WordPress plugin Hippoo Mobile App for WooCommerce 授权问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

CVE-2026-10580: Improper Authorization

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::getuserpermissions, which returns the same null sentinel f...

HelloTalk 安全漏洞

HelloTalk is a language exchange and social learning app developed by HelloTalk Corporation. Versions of HelloTalk 3.4.1 and earlier contained a security vulnerability. This vulnerability stemmed from the storage of full-precision GPS coordinates. Even if users intended to only share their countr...

CVE-2019-25727

creationtimestamp| type| source ---|---|--- 2026-06-04 23:27:58+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnirmjtf7n25 2026-06-04 23:30:28+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnirqyr22a26...

DEBIAN-CVE-2026-11175

Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-11023

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11023

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-11008

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11008

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-10923

Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: High...

CVE-2026-11283

Google Chrome on Mac versions prior to 149.0.7827.53 is vulnerable to a policy bypass in Shortcuts due to insufficient validation of untrusted input. A remote attacker can exploit this flaw via a malicious file to bypass navigation restrictions. The vulnerability is associated with CWE-20 (Improp...