31752 matches found
CVE-2025-60156
creationtimestamp| type| source ---|---|--- 2025-09-28 00:02:50+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzu6yorayg2k...
CVE-2025-60164
Cross-Site Request Forgery CSRF vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through = 2.7.7...
Neon App pays users to record their phone calls, sells data for AI training [updated]
TechCrunch reports about a “bizarre app” inviting you to record and share your audio calls so that it can sell the data to AI companies. And if that’s not weird enough on its own, it’s ranking No. 2 in Apple's US app store at the time of writing. The name of the app is Neon Mobile and it promises...
MAL-2025-47720 Malicious code in raas-client-app (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-47666 Malicious code in example-nestjs-api (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-47610 Malicious code in ai-communication-app (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ai-communication-app (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-60164
Cross-Site Request Forgery CSRF vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through = 2.7.7...
CVE-2025-10136
CVE-2025-10136 concerns the WordPress plugin TweetThis Shortcode. The TweetThis Shortcode plugin is vulnerable to Stored Cross-Site Scripting via its tweetthis shortcode in all versions up to and including 1.8.0 due to insufficient input sanitization and output escaping on user-supplied attribute...
Bridging Technical Capability and User Accessibility: Off-Grid Civilian Emergency Communication
During large-scale crises disrupting cellular and Internet infrastructure, civilians lack reliable methods for communication, aid coordination, and access to trustworthy information. This paper presents a unified emergency communication system integrating a low-power, long-range network with a...
CVE-2025-7106
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some to validate permissions, which incorrectly grants access if only one of multiple required...
Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution [CVE-2025-7783]
Summary Node.js module form-data is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution. This bulletin provides patch information to address the reported vulnerability in Node.js module form-dat...
CVE-2025-41715
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it...
Malicious Package
Overview @dropbox-photo-viewer/electron-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
MAL-2025-47523 Malicious code in @dropbox-photo-viewer/electron-app (npm)
The package @dropbox-photo-viewer/electron-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0e60f8bd38264b681d07237c310d98471fc7bfc1b9ab2bfabf4258bf01a9ea9 Any computer that has this package installed or running should be...
CVE-2025-56146
Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity...
Reachable Assertion
Overview Affected versions of this package are vulnerable to Reachable Assertion in the torch.linalg.lu function. In AOTAutograd mode LU decomposition can't accept slice operation and An attacker can cause the application to become unresponsive or crash if backend="aoteager" by providing speciall...
CVE-2025-21481
CVE-2025-21481 is linked to memory corruption during private key encryption in a trusted application, specifically within the Adreno GPU DRM driver. The PT-2025-23797 entry describes a use-after-free condition in the Direct Rendering Manager (DRM) Driver of the Adreno GPU, affecting unspecified A...
CVE-2025-10906
CVE-2025-10906 affects Magnetism Studios Endurance on macOS (versions up to 3.3.0). The vulnerability lies in the NSXPC Interface, specifically loadModuleNamed:WithReply in /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper, enabling local manipulati...