trueseeing

README trueseeing ist ein schneller, genauer und robuster Schwachstellenscanner für iOS-/Android-Apps. Wir arbeiten auf der Dalvik-VM-Ebene für Android – d.h. es ist uns egal, ob die Ziel-App obfuskiert ist oder nicht. Fähigkeiten Derzeit können wir: Automatisches Scannen der App auf...

morf

MORF Framework di Ricognizione Mobile Un potente toolkit di sicurezza offensiva per l'analisi di applicazioni mobili Trova Segreti. Proteggi le App. Rimanete Sicuri. 📋 Indice 💡 Panoramica 🚀 Avvio Rapido 🔍 Caratteristiche Principali 🏗️ Architettura 📋 Casi d'Uso Comuni 📦 Installazione Prerequisiti...

Brida

Brida Brida ist eine Burp Suite-Erweiterung, die als Brücke zwischen Burp Suite und Frida fungiert und es Ihnen ermöglicht, die eigenen Methoden von Anwendungen zu verwenden und zu manipulieren, während der Datenverkehr zwischen den Anwendungen und ihren Backend-Diensten/Servern abgefangen und...

MobileHackersWeapons

Una collezione di fantastici strumenti utilizzati dagli hacker mobile. Buon hacking, buona caccia ai bug! Progetto famiglia Indice dei contenuti Armi Contribuisci Ringraziamenti ai collaboratori Armi Attributi Tutti iOS Android Ringraziamenti ai collaboratori Il progetto open-source WHW è stato...

MobSF_AI

MobSF AI Sidecar Este projeto adiciona um assistente de chat com IA ao Mobile Security Framework MobSF. Ele permite que analistas de segurança façam perguntas sobre o relatório de análise gerado pelo MobSF diretamente na interface, utilizando o modelo da OpenAI. Funcionalidades Integração Perfeit...

slythestx

🐍 Slythestx Il verme svizzero della sicurezza mobile Un framework unificato per l'analisi statica del codice e la caccia dinamica alle vulnerabilità su iOS e Android. !Buy Me A...

maswe

OWASP Mobile Application Security Weakness Enumeration MASWE Die OWASP Mobile Application Security Weakness Enumeration MASWE ist eine Liste häufiger Sicherheits- und Datenschutzschwächen in mobilen Anwendungen. Sie dient als Referenz für Entwickler, Sicherheitsforscher und Sicherheitsexperten. S...

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

CVE-2026-17822

CVE-2026-17822 describes a race condition in Chrome for iOS (Google Chrome on iOS) prior to version 151.0.7922.72 that can allow a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability affects Chrome on iOS and is categorized with a medium severity; the attack vector i...

CVE-2026-17782

Affected software: Google Chrome on iOS (Chrome for iOS). Vulnerability vector/impact: Incorrect security UI allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Affected version: on iOS prior to 151.0.7922.72. Root cause: security UI flaw in the Omnib...

We rebuilt Malwarebytes Mobile Security for the scams of today

Nearly half of people encounter a scam on their phone every single day. Malwarebytes is doing something about it. That figure comes from a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe. The results paint a troubling picture. A quarter of the victims surveyed reported bein...

CVE-2026-64734

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted contact may leak sensitive data...

CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability

...

PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Vulnerable MobSF Versions: = v4.3.2Details:MobSF is a widely adopted mobile application security testing tool used by security teams across numerous organizations. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications...

PYSEC-2026-1673 MobSF Stored Cross-Site Scripting (XSS)

Product: MobSF Version: CFBundleIdentifier value. In the dynamicanalysis.html file you do not sanitize...

PYSEC-2026-1666 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

Summary The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerabilit...

PYSEC-2026-1676 Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

Impact What kind of vulnerability is it? Who is impacted? SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possib...

PYSEC-2026-848 MobSF allows attackers to read arbitrary files via a crafted HTTP request

Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...