CVE-2026-34082 Dify has IDOR in deleting someone else's chat conversation

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method DELETE /console/api/installed-apps//conversations/ has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue...

CVE-2026-34082

CVE-2026-34082 affects the open-source platform Dify . A flaw in the authorization of the endpoint DELETE /console/api/installed-apps//conversations/ (prior to 1.13.1) allows any authenticated user to delete another user’s chat history, an IDOR-type vulnerability. This could enable unauthorized a...

FakeWallet crypto stealer spreading through iOS apps in the App Store

In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distributing trojanized versions of legitimate wallets. The infected ap...

The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables

An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supp...

dify 安全漏洞

Dify is an open-source LLM application development platform developed by LangGenius. Versions of Dify prior to 1.13.1 contained a security vulnerability. This vulnerability stemmed from insufficient authorization checks in the DELETE /console/api/installed-apps//conversations/ method, which could...

New RecruitRat, SaferRat, Astrinox, Massiv Android Malware Found Targeting 800 Apps

New research from Zimperium reveals four active Android malware campaigns, RecruitRat, SaferRat, Astrinox, and Massiv, targeting over 800 banking apps globally...

EUVD-2026-23388

Red Magic 11 Pro NX809J contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific...

CVE-2026-40002

Red Magic 11 Pro NX809J contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific...

CVE-2026-40002

Red Magic 11 Pro NX809J contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific...

CVE-2026-40002

The CVE-2026-40002 entry concerns ZTE Red Magic 11 Pro (NX809J). The vulnerability arises from a lack of validation when apps access a service interface, enabling non-privileged applications to trigger sensitive operations. Reported impact in sources includes ability to write files to specific pa...

CVE-2026-40002 ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.

Red Magic 11 Pro NX809J contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an attacker can write files to specific...

PT-2026-33421

Name of the Vulnerable Software and Affected Versions Red Magic 11 Pro NX809J affected versions not specified Description Lack of validation for applications accessing the service interface allows non-privileged applications to trigger sensitive operations. This can enable an attacker to write...

ZTE Red Magic 11 Pro 安全漏洞

The ZTE Red Magic 11 Pro is a smartphone designed for high-performance gaming experiences by ZTE Corporation. The ZTE Red Magic 11 Pro NX809J has a security vulnerability that stems from a lack of verification for applications accessing service interfaces. This vulnerability may allow...

[SECURITY] Fedora 44 Update: kde-gtk-config-6.6.4-1.fc44

This is a System Settings configuration module for configuring the appearance of GTK apps in KDE...

BIT-AUTHENTIK-2024-47077 authentik cross-provider token validation problems

authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued...

Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

Summary A Paperclip-managed codexlocal runtime was able to access and use a Gmail connector that I had connected in the ChatGPT/OpenAI apps UI, even though I had not explicitly connected Gmail inside Paperclip or separately inside Codex. In my environment this enabled mailbox access and a real...

GHSA-GQQJ-85QM-8QHF Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

Summary A Paperclip-managed codexlocal runtime was able to access and use a Gmail connector that I had connected in the ChatGPT/OpenAI apps UI, even though I had not explicitly connected Gmail inside Paperclip or separately inside Codex. In my environment this enabled mailbox access and a real...

Malicious code in aca-review-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4019ca27647236621668ae5e45dd104c23d60ad5b64fd5179ad09efda40cc345 The package aca-review-apps was found to contain malicious code...

MAL-2026-2720 Malicious code in aca-review-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4019ca27647236621668ae5e45dd104c23d60ad5b64fd5179ad09efda40cc345 The package aca-review-apps was found to contain malicious code...

[SECURITY] Fedora 42 Update: moby-engine-29.4.0-1.fc42

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...