CVE-2026-0005

In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and...

CVE-2026-0005

Technical details about CVE-2026-0005 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-9224

In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and...

CVE-2025-48619

CVE-2025-48619 affects Android’s ContentProvider.java (ContentProvider) where a logic error can let an app with read-only access truncate files, causing local elevation of privilege without extra privileges or user interaction. Public sources (NVD/NVDCNVD) describe the issue and note Android secu...

CVE-2026-28412 Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server...

CVE-2026-28412

CVE-2026-28412 affects Textream, a macOS teleprompter app. The DirectorServer WebSocket server allows unlimited concurrent connections, and when combined with a broadcast timer sending state to all clients every 100 ms, it can exhaust CPU and memory, freezing/crashing the application during live ...

EUVD-2026-9201

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service (CVE-2025-61726, CVE-2025-61728) and loss of confidentiality (CVE-2025-61730)

Summary IBM App Connect Enterprise Certified Container operator, and DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service CVE-2025-61726, CVE-2025-61728 and loss of confidentiality CVE-2025-61730. This bulletin provides patch information to...

EUVD-2026-9174

Mattermost Desktop App versions =5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server...

CVE-2026-1628

Mattermost Desktop App versions =5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service (CVE-2026-2327)

Summary Node.js module markdown-it is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to regular expression denial of service ReDoS. This bulletin provides...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality (CVE-2026-24398, CVE-2026-24472, CVE-2026-24473, CVE-2026-24771)

Summary Node.js module Hono is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported...

EUVD-2025-208152

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls...

CVE-2025-30035

creationtimestamp| type| source ---|---|--- 2026-03-02 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2025-10350/ 2026-03-02 11:59:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg37co23mj2n...

CVE-2026-3405

creationtimestamp| type| source ---|---|--- 2026-03-02 04:03:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg2ep73k472z 2026-03-03 03:08:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116163037793945583...

Multiple Apple Products Information Disclosure Vulnerability (CNVD-2026-14478)

Apple watchOS is a smartwatch operating system. apple macOS is a dedicated operating system developed for Mac computers. apple visionOS is an operating system for AR glasses. An information disclosure vulnerability exists in multiple Apple products and is caused due to an issue with the handling ...

Exploiting PendingIntent Provenance Confusion to Spoof Android SDK Authentication

A single authentication bypass in a partner SDK grants attackers the identity of every partner in the ecosystem -- and millions of apps use SDKs with exactly this vulnerability. OWASP's 2024 Mobile Top 10 ranks Inadequate Supply Chain Security as the second most critical mobile risk, explicitly...

Multiple Apple Product Code Execution Vulnerabilities (CNVD-2026-26099)

Apple iOS is an operating system developed for mobile devices. Apple macOS is a dedicated operating system developed specifically for Mac computers. Apple iPadOS is an operating system used for iPad tablets. Several Apple products have code execution vulnerabilities, and attackers can exploit the...

PT-2026-22670

In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and...

PT-2026-22626

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server...