CVE-2025-9708

creationtimestamp| type| source ---|---|--- 2025-09-16 14:11:59+00:00| seen| https://seclists.org/oss-sec/2025/q3/169 2025-09-16 17:02:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lyxsfpzkhn2p 2025-09-16 18:06:08+00:00| seen|...

CVE-2025-24088

The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to override MDM-enforced settings from profiles...

CVE-2025-10452

creationtimestamp| type| source ---|---|--- 2025-09-15 04:31:58+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lytxxxdwn72d 2025-09-15 05:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyu2iyut2i2x...

PT-2025-37777

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Tahoe 26 Description: An application may be able to override Mobile Device Management MDM-enforced settings from profiles. The issue was addressed by adding additional logic. Recommendations: Update to macOS Tahoe 26 o...

GHSA-4269-MCFH-CP7Q Indico may disclose unauthorized user details access via legacy API

Impact A legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds It ...

CVE-2025-10155

creationtimestamp| type| source ---|---|--- 2025-09-10 19:51:37+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jgw4-cr84-mqxg 2025-09-17 10:31:59+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyzmzk6thf2o 2025-09-17 11:32:14+00:00| seen|...

CVE-2025-59034

The CVE-2025-59034 affects Indico before version 3.3.8, where a legacy API for retrieving user details could disclose profile data of other users due to a broken access check in Flask-Multipass-based authentication. The issue enables unauthorized access without admin permissions; impact is limite...

CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-9943

creationtimestamp| type| source ---|---|--- 2025-09-10 08:01:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyhre4bny42r 2025-09-10 08:46:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyhttvtwpt2r...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

Avigilon ACM version v7.10.0.20 is vulnerable to a CSV injection vulnerability in the /id_profiles API endpoint. This flaw allows an attacker to execute arbitrary code by supplying a specially crafted Excel file. As a temporary workaround, it is recommended to restrict access to the /id_profiles ...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

PT-2025-36486

Name of the Vulnerable Software and Affected Versions: Avigilon ACM version 7.10.0.20 Description: A CSV injection vulnerability exists in the /id profiles API endpoint of the software. This allows attackers to execute arbitrary code by supplying a crafted Excel file. Recommendations: As a...

CVE-2025-21037

Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...