CVE-2026-31370

CVE-2026-31370 affects Honor E APP with an information leak vulnerability that may compromise service confidentiality. From the provided data, the CVSSv3.1 base score is 6.3 (MEDIUM): AV:N, AC:L, PR:N, UI:R, S:U, C:L, I:L, A:L. It requires user interaction and has a network attack vector but does...

CVE-2026-31370 Information Leak Vulnerability in Honor E

Honor E APP is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality...

EUVD-2026-24039

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in releaseupdate.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue...

Honor E APP 安全漏洞

Honor E APP is a smart device companion app developed by the Chinese company Honor. There is a security vulnerability in Honor E APP, which stems from information leakage and may affect the confidentiality of services...

Oracle Life Sciences InForm 安全漏洞

Oracle Life Sciences InForm is a clinical trial data collection and management system developed by Oracle Corporation. Versions 7.0.1.0 and 7.0.1.1 of Oracle Life Sciences InForm contain security vulnerabilities. These vulnerabilities stem from issues with the App Server component, which may allo...

PT-2026-33918

Name of the Vulnerable Software and Affected Versions Honor E APP affected versions not specified Description An information leak exists that may affect service confidentiality if successfully exploited. Recommendations At the moment, there is no information about a newer version that contains a...

FreeScout 安全漏洞

FreeScout is a lightweight and powerful free open-source help desk and shared inbox built using PHP Laravel framework by FreeScout Inc. Versions of FreeScout prior to 1.8.213 contained security vulnerabilities. These vulnerabilities stemmed from the linkify function in app/Misc/Helper.php, which...

PT-2026-33992

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP KEY, which is exposed ...

EUVD-2026-23876

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-6650

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-6650 Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-6650

Z-BlogPHP 1.7.5 contains a vulnerability in the App::UnPack function of /zb_users/plugin/AppCentre/app_upload.php (ZBA File Handler) that allows unrestricted file upload. Impact is described as unrestricted upload with network/remote initiation; exploitation is publicly available per the CVE entr...

CVE-2026-6650 Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-6634

UseMemoS memos up to 0.22.1 has a vulnerability in the UpdateInstanceSetting component, specifically the memos_access_token function in src/App.tsx. The issue stems from manipulation of the additionalStyle/additionalScript arguments, leading to improper authorization. Exploitation is possible rem...

FakeWallet crypto stealer spreading through iOS apps in the App Store

In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distributing trojanized versions of legitimate wallets. The infected ap...

FakeWallet crypto stealer spreading through iOS apps in the App Store

In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distributing trojanized versions of legitimate wallets. The infected ap...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Arbitrary Code Injection due to Node js module jsonpath (CVE-2026-1615)

Summary IBM App Connect Enterprise runtime is vulnerable to Arbitrary Code Injection due to Node js module jsonpath. Vulnerability Details CVEID:CVE-2026-1615 DESCRIPTION: Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-suppli...

CVE-2026-6643

creationtimestamp| type| source ---|---|--- 2026-04-20 07:50:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvybbngej2h 2026-04-20 09:17:22+00:00| seen| Telegram/Lm9dzPhVRFRRMgyzsUGG1X5A2Qj2Q71JCDe8XQUe2-0mpLw 2026-04-28 09:00:05+00:00| seen|...

CVE-2026-27780

creationtimestamp| type| source ---|---|--- 2026-04-20 05:04:51+00:00| seen| https://bsky.app/profile/vmorecloud.bsky.social/post/3mjvoyk7fjb2y 2026-07-06 16:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyifos7uh2e...

EUVD-2026-23737

A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/usermanager.py of the component userdata Endpoint. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclose...