Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to URL validation bypass [CVE-2025-56200]

Summary node.js module validator is used by IBM App Connect Enterprise Certified Container for data validation. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to URL validation bypass. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and code injection [CVE-2025-57350]

Summary Node.js module csvtojson is used by IBM App Connect Enterprise Certified Container for processing CSV data. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationRuntime and IntergrationServer operands are vulnerable to denial of service and code injection. This...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to Apache Commons Lang ( CVE-2025-48924 )

Summary IBM App Connect Enterprise runtime and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to Apache Commons Lang. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime (CVE-2025-53057 & CVE-2025-53066))

Summary IBM App Connect Enterprise is vulnerable to Improper Access Control and Exposure of Sensitive Information to an Unauthorized Actor due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2025-53057 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and DesignerAuthoring operands are vulnerable to loss of integrity [CVE-2025-47907]

Summary IBM App Connect Enterprise Certified Container operator and DesignerAuthoring operands are vulnerable to loss of integrity due to a vulnerability in the Golang module database/sql. This bulletin provides patch information to address the reported vulnerability in database/sql. CVE-2025-479...

CVE-2025-66228

creationtimestamp| type| source ---|---|--- 2025-11-26 06:51:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6jbdqiebp2n...

CVE-2025-66256

creationtimestamp| type| source ---|---|--- 2025-11-26 04:21:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6iyxlrvbz2j 2025-11-26 15:28:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115616705516119073...

CVE-2025-66022

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote cod...

CVE-2025-66022

CVE-2025-66022 affects FACTION prior to 1.7.1. An unauthenticated extension upload via the /portal/AppStoreDashboard endpoint, plus an extension execution path in the extension framework, permits untrusted code to execute arbitrary system commands on the server, enabling remote code execution on ...

EUVD-2025-199690

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote cod...

Exploring Hidden Geographic Disparities in Android Apps

While mobile app evolution has been widely studied, geographical variation in app behavior remains largely unexplored. This paper presents a large-scale study of location-based Android app differentiation, uncovering two important and underexamined phenomena with security and fairness implication...

Ubuntu: Security Advisory (USN-7851-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-61168

creationtimestamp| type| source ---|---|--- 2025-11-25 21:48:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6icyw4acv2w...

CVE-2025-64304

"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys...

CVE-2025-64304

"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys...

CVE-2025-0003

creationtimestamp| type| source ---|---|--- 2025-11-25 01:20:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6g6f5ky572n...

Malicious code in n8n-nodes-viral-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b674c80512825238bef8f46f867856034796bf31343fa3c9e20f4b74e9b6da8f The package n8n-nodes-viral-app was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199363

Malicious code in n8n-nodes-viral-app npm...

console 路径遍历漏洞

console is an application by Grayson Groshong Individual Developer. A path traversal vulnerability exists in console versions prior to 2.8.0, which stems from a path traversal that could result in a write to a non-target directory...

FujiTelevison FOD app 安全漏洞

FujiTelevison FOD app is an on-demand mobile app from FujiTelevison Japan. A security vulnerability exists in the FujiTelevison FOD app that stems from the use of hard-coded encryption keys, which could lead to a local attacker obtaining the keys...