CVE-2025-21608

CVE-2025-21608 affects Meshtastic firmware; forged packets over MQTT can be shown as direct messages in a client to a node because PKC decoding failed. Root cause: packets crafted over MQTT were not decoded with PKC, enabling visibility of a DM in the client. Impact is described as partial (integ...

PT-2025-6926 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic versions prior to 2.5.19 Description: Meshtastic is an open source mesh networking solution. In affected firmware versions, crafted packets over MQTT can appear as a DM in client to a node even though they were not decoded with PKC...

CVE-2025-0503

Mattermost versions 9.11.x = 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database...

CVE-2025-0503

Mattermost versions 9.11.x = 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database...

CVE-2025-0503 Leaked User IDs and Metadata of Deleted DMs

Mattermost versions 9.11.x = 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database...

CVE-2025-0503

Mattermost 9.11.x

PT-2025-6788 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.6 Description: The issue allows an attacker to infer user IDs and other metadata from deleted direct messages DMs if someone had manually marked DMs as deleted in the database. This is possible because...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

CVE-2024-36289

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a man-in-the-middle attack...

CVE-2024-36289

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a man-in-the-middle attack...

CVE-2024-36289

CVE-2024-36289 concerns FreeFrom - the nostr client prior to version 1.3.5. The vulnerability arises from reusing a nonce/key pair in encryption, enabling a man-in-the-middle to potentially manipulate the content of direct messages (DMs) between users. Affected platforms include Android and iOS a...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

CVE-2024-36279

CVE-2024-36279 concerns “FreeFrom - the nostr client” (Android/iOS) versions prior to 1.3.5. The issue is reliance on obfuscation or encryption of security‑relevant inputs without proper integrity checking, enabling a man‑in‑the‑middle to manipulate the content of Direct Messages (DMs). The vulne...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

FreeFrom Security Vulnerabilities

FreeFrom is an application from FreeFrom, Inc. dedicated to bringing privacy and free speech back to SNSs. A security vulnerability exists in FreeFrom the nostr client prior to version 1.3.5 that stems from the application having a dependency on obfuscating or encrypting security-related input...

PT-2024-26947 · Freefrom · Freefrom

Name of the Vulnerable Software and Affected Versions: FreeFrom - the nostr client versions prior to 1.3.5 Description: The issue exists due to reliance on obfuscation or encryption of security-relevant inputs without integrity checking. If exploited, the content of direct messages between users...

FreeFrom Security Vulnerabilities

FreeFrom is an application from FreeFrom, Inc. dedicated to bringing privacy and free speech back to SNSs. A security vulnerability exists in versions of FreeFrom prior to 1.3.5 that stems from the application's reuse of random number key pairs, resulting in direct message DM content between user...

TikTok Hack Targets ‘High-Profile’ Users via DMs

TikTok has confirmed a “potential exploit” that is being used to go after accounts belonging to media organizations and celebrities, including CNN and Paris Hilton, through direct messages...

CVE-2023-5193 System Role with manage posts permission can read posts of Direct Messages

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...

PT-2023-31901 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly check permissions when retrieving a post, allowing a System Role with the permission to manage channels to read the posts of a DM conversation...