242 matches found
CVE-2025-14081
Technical details for CVE-2025-14081 are not publicly disclosed in the provided documents. Monitor for updates from vendors and security advisories.
PT-2025-51861
The Ultimate Member plugin for WordPress is vulnerable to Profile Privacy Setting Bypass in all versions up to, and including, 2.11.0. This is due to a flaw in the secure fields mechanism where field keys are stored in the allowed fields list before the required perm check is applied during...
EUVD-2025-203091
Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2...
Wave Terminal 代码注入漏洞
Wave Terminal is an enterprise collaboration system from Wave Terminal open source. A code injection vulnerability exists in Wave Terminal version 0.12.2, which stems from Electron Fuses code injection and could lead to a TCC bypass...
CVE-2025-66027
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled...
CVE-2025-66027
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled...
CVE-2025-66027 Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled...
CVE-2025-66027
CVE-2025-66027 describes an information disclosure in Rallly prior to 4.5.6. The vulnerability allows disclosure of participant details (names and email addresses) through the endpoints /api/trpc/polls.get and polls.participants.list, even when Pro privacy features are enabled. The root cause is ...
CVE-2025-66027 Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled...
EUVD-2025-199883
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled...
PT-2025-48352
Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.6 Description Rallly is a scheduling and collaboration tool. A flaw allows unauthorized disclosure of participant details, such as names and email addresses. This occurs through the...
Malicious code in gita-buburayam60-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66d4690de2a4675fa3bba6cd6a2aca4ad2090b345f7aed42c9995e177b56d0e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-90657 Malicious code in siska-rojak32-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb94d6179bd2b061eac732badb48988b60250fa43e200cf70b73bd09bf599478 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-43502
A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app may be able to bypass certain Privacy preferences...
CVE-2025-43288
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7. An app may be able to bypass Privacy preferences...
CVE-2025-43288
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy preferences...
CVE-2025-43288
The CVE-2025-43288 issue affects macOS Sequoia and is tied to Archive Utility’s handling of symlinks. The vulnerability could allow an app to bypass Privacy preferences due to insufficient validation of symbolic links. Apple states the flaw is addressed with improved validation of symlinks and is...
PT-2025-44909
Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 26.1 Apple iPadOS versions prior to 26.1 Apple Safari version 26.1 Apple visionOS versions prior to 26.1 Description A privacy issue existed where an application could potentially bypass certain privacy preferences...