CVE-2025-14553 Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...

CVE-2025-14553

Summary: CVE-2025-14553 concerns TP-Link Tapo mobile apps (iOS/Android) exposing password hashes via an unauthenticated API response, enabling attackers on the local network to brute-force credentials. Multiple connected sources confirm: affected product scope includes TP-Link Tapo cameras; impac...

CVE-2025-13474

Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8...

CVE-2025-13474 IDOR in Menulux Software's Mobile App

Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8...

CVE-2025-13474

Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8...

CVE-2025-13474

Summary of CVE-2025-13474 Affected product: Menulux Software Inc. Mobile App (versions before 9.5.8). Vulnerability: Authorization bypass through a user-controlled key that enables exploitation of trusted identifiers. Impact: The description indicates an authorization bypass affecting the mobile ...

CVE-2025-13474 IDOR in Menulux Software's Mobile App

Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8...

UIXPOSE: Mobile Malware Detection Via Intention-Behaviour Discrepancy Analysis

We introduce UIXPOSE, a source-code-agnostic framework that operates on both compiled and open-source apps. This framework applies Intention Behaviour Alignment IBA to mobile malware analysis, aligning UI-inferred intent with runtime semantics. Previous work either infers intent statically, e.g.,...

PT-2025-51777

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C210 versions 1.8 Description An unauthenticated API response exposes password hashes in the TP-Link Tapo C210 application on iOS and Android. This allows attackers to attempt to brute force the password within the local network...

PT-2025-51473

Name of the Vulnerable Software and Affected Versions Menulux Software Inc. Mobile App versions prior to 9.5.8 Description An authorization bypass exists in the Menulux Software Inc. Mobile App due to a vulnerability related to user-controlled keys and the exploitation of trusted identifiers. Thi...

Menulux Mobile App 安全漏洞

Menulux Mobile App is a mobile application from Menulux Turkey. A security vulnerability exists in Menulux Mobile App versions prior to 9.5.8, which stems from an authorization bypass that could lead to the exploitation of trusted identifiers...

CVE-2025-14023

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions...

CVE-2025-14022

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of netwo...

CVE-2025-14022

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of netwo...

CVE-2025-14021

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content...

CVE-2025-14021

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content...

PT-2025-51207

Name of the Vulnerable Software and Affected Versions LINE client for iOS versions prior to 15.19 Description The LINE client for iOS is susceptible to a UI spoofing issue stemming from inconsistencies between the application's navigation state and the user interface of the in-app browser. This...

CVE-2025-43437

CVE-2025-43437 describes an information disclosure where an app may fingerprint a user, due to privacy control weaknesses. The vulnerability is fixed in iOS 26.1 and iPadOS 26.1. Affected: Apple iOS and iPadOS prior to 26.1. Remediation: upgrade to iOS 26.1 / iPadOS 26.1 or later. Public details ...

CVE-2025-43530

This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.2, macOS Sonoma 14.8.3, macOS Sequoia 15.7.3, iOS 18.7.3 and iPadOS 18.7.3. An app may be able to access sensitive user data...

CVE-2025-43511

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash...