17010 matches found
CVE-2025-43977
The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component...
SKTelecom com.skt.prod.dialer security vulnerability
SKTelecom com.skt.prod.dialer is an official dialing and call management application from SKTelecom Korea. A security vulnerability exists in SKTelecom com.skt.prod.dialer version 12.5.0 and earlier, which stems from a vulnerability that allows arbitrary applications to make phone calls via a...
Canonical MAAS security vulnerabilities
Canonical MAAS is a Canonical open source software for large-scale physical server management and automated deployment. A security vulnerability exists in Canonical MAAS that stems from insufficient authentication and could allow an attacker to bypass authentication checks and run RPC commands...
com.enflick.android.tn2ndLine security vulnerability
com.enflick.android.tn2ndLine is an application. A security vulnerability exists in com.enflick.android.tn2ndLine version 24.17.1.0 and earlier, which stems from a vulnerability that allows arbitrary apps to make phone calls via a specially crafted intent, which could result in a phone call witho...
(Pwn2Own) Phoenix Contact CHARX SEC-3150 DHCP Configuration Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration service, which listens on TCP port 50...
PiMRef: Detecting and Explaining Ever-Evolving Spear Phishing Emails with Knowledge Base Invariants
Phishing emails are a critical component of the cybercrime kill chain due to their wide reach and low cost. Their ever-evolving nature renders traditional rule-based and feature-engineered detectors ineffective in the ongoing arms race between attackers and defenders. The rise of large language...
CVE-2025-53928 MaxKB has RCE in MCP call
MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue...
CVE-2025-53928
MaxKB has a Remote Command Execution vulnerability in the MCP call present in versions prior to 1.10.9-lts and 2.0.0. The issue is fixed in 1.10.9-lts and 2.0.0. No exploitation details are provided beyond this, and remediation is to upgrade to the fixed versions.
PT-2025-33568
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel related to interrupt handling within the rxrpc subsystem. Specifically, the rxrpc assess MTU size function, called from rxrpc new incoming call, can...
CVE-2025-53928: Improper Control of Generation of Code
MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue...
Cisco Identity Services Engine invokeStrongSwanShellScript Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the invokeStrongSwanShellScript method. The issue...
PT-2025-33565
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The Linux kernel contains a flaw within the scheduler extension sched/ext related to calls to the update locked rq function with a NULL runqueue rq pointer. Invoking update locked rqNU...
CBI Shuts Down £390K U.K. Tech Support Scam, Arrests Key Operatives in Noida Call Center
India's Central Bureau of Investigation CBI has announced that it has taken steps to dismantle what it said was a transnational cybercrime syndicate that carried out "sophisticated" tech support scams targeting citizens of Australia and the United Kingdom. The fraudulent scheme is estimated to ha...
CBI Shuts Down £390K U.K. Tech Support Scam, Arrests Key Operatives in Noida Call Center
India's Central Bureau of Investigation CBI has announced that it has taken steps to dismantle what it said was a transnational cybercrime syndicate that carried out "sophisticated" tech support scams targeting citizens of Australia and the United Kingdom. The fraudulent scheme is estimated to ha...
kernel: um: Fix out-of-bounds read in LDT setup
A vulnerability was found in the Linux kernel's user mode um subsystem, specifically within the Local Descriptor Table LDT setup functionality. The issue arises from the syscallstubdata function misinterpreting the datacount parameter as a byte count rather than a count of longs, leading to an...
CVE-2021-4458
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wpajaxmecloadsinglepage' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
@atomrigslab/better-auth (>=1.2.6-beta.6, <=1.2.6-beta.25), @better-auth/cli (>=1.2.0-beta.1, <=1.2.0-beta.9) +6 more potentially affected by unknown CVE via better-call (>=1.0.0-beta.4, <=1.0.11)
better-call NPM version =1.0.0-beta.4, =1.2.6-beta.6, =1.2.0-beta.1, =1.2.0-beta.1, =1.2.10-pkce-fix.4, =1.2.14, =1.2.0-beta.1, =1.2.0-beta.9 - chiron-sh 0.0.1-alpha.1 Source cves: unknown CVE Source advisory: GHSA-HQ75-XG7R-RX6C...
GHSA-HQ75-XG7R-RX6C Better Call routing bug can lead to Cache Deception
Summary Using a CDN that caches //.png, //.json, //.css, etc... requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and personal data when cached responses are served to other users. Details The vulnerability occurs in the request processing logic where...
@atomrigslab/better-auth (>=1.2.6-beta.6, <=1.2.6-beta.25), @better-auth/cli (>=1.2.0-beta.1, <=1.2.0-beta.9) +6 more potentially affected by unknown CVE via better-call (>=1.0.0-beta.4, <=1.0.11)
better-call NPM version =1.0.0-beta.4, =1.2.6-beta.6, =1.2.0-beta.1, =1.2.0-beta.1, =1.2.10-pkce-fix.4, =1.2.14, =1.2.0-beta.1, =1.2.0-beta.9 - chiron-sh 0.0.1-alpha.1 Source cves: unknown CVE Source advisory: OSV:GHSA-HQ75-XG7R-RX6C...
