CVE-2025-46732

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL "NotificationLineNotificationMarkReadMutation" and "NotificationLineNotificationDeleteMutation" mutations of OpenCTI allows an...

CVE-2025-50028

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

mailcow: dockerized 安全漏洞

mailcow: dockerized is a dockerized mailcow application from mailcow open source. A security vulnerability exists in versions prior to mailcow: dockerized 2025-07 that stems from a server-side template injection in the notification template system that could lead to code execution...

CVE-2025-50028

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

WordPress plugin Ultimate Push Notifications 安全漏洞

WordPress Ultimate Push Notifications is a plugin that is mainly used to implement real-time push functionality in WordPress websites, supporting sending desktop and mobile device notifications to users. WordPress Ultimate Push Notifications suffers from a lack of authorization vulnerability, no...

CVE-2025-50028: Missing Authorization

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

PT-2025-29810 · Unknown · Codesolz Ultimate Push Notifications

Name of the Vulnerable Software and Affected Versions: CodeSolz Ultimate Push Notifications versions through 1.1.9 Description: The software contains a missing authorization flaw due to incorrectly configured access control security levels. Recommendations: Update CodeSolz Ultimate Push...

CVE-2025-38278 octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TCHTBLEAFDELLAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marki...

Android May Soon Warn You About Fake Cell Towers

Plus: Iran-linked hackers threaten to release Trump campaign emails, Chinese hackers still in US telecoms networks, and an abusive deepfake website plans an expansion...

xorc-notifications (0.1.0) potentially affected by CVE-2025-53604 via web-push (0.4.2)

web-push CARGO version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on web-push and may be impacted: - xorc-notifications 0.1.0 Source cves: CVE-2025-53604 Source advisory: OSV:GHSA-287X-9RFF-QVCG...

CVE-2025-5924: Cross-Site Request Forgery (CSRF)

The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpnbrodcastnotificationmessage function. This makes it possible for unauthenticated attacker...

Malicious code in notifications-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97d85b541866edfdc9a987e188439cb632fc50a8841072cc43eef2d044f30c8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in notifications-item

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

[SECURITY] Fedora 41 Update: gotify-desktop-1.3.7-5.fc41

Small Gotify daemon to receive messages and forward them as desktop notificat ions. Read Gotify messages, and forward them as standard desktop notification . Forward message priority. Auto reconnect if server connection is lost and g et missed messages. Automatically download, cache, and show app...

[SECURITY] Fedora 42 Update: gotify-desktop-1.3.7-5.fc42

Small Gotify daemon to receive messages and forward them as desktop notificat ions. Read Gotify messages, and forward them as standard desktop notification . Forward message priority. Auto reconnect if server connection is lost and g et missed messages. Automatically download, cache, and show app...

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...

CVE-2025-49134

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12...

CVE-2025-49134

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12...

CVE-2025-49134

Weblate (localization tool) exposed user IPs via audit log email notifications prior to version 5.12; IPs could be harvested by third‑party servers (SMTP relays, spam filters). The issue is resolved by patching in Weblate 5.12 (5.12.1 recommended).

CVE-2025-49134 Weblate exposes personal IP address via e-mail

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12...