CVE-2025-65501

Null pointer dereference in coapdtlsinfocallback in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSLgetappdata returns NULL...

Xtool AnyScan App 安全漏洞

Xtool AnyScan App is an automotive diagnostic mobile application from China-based Xtool. A security vulnerability exists in Xtool AnyScan App version 4.40.40 and earlier, which stems from the use of a hard-coded key to decrypt update metadata...

CVE-2025-65501

Null pointer dereference in coapdtlsinfocallback in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSLgetappdata returns NULL...

Xtool AnyScan App 安全漏洞

Xtool AnyScan App is an automotive diagnostic mobile application from China-based Xtool. A security vulnerability exists in Xtooltech Xtool AnyScan Android Application version 4.40.40 and earlier, which stems from a lack of SSL certificate validation and could lead to a man-in-the-middle attack...

CVE-2025-63432

The Xtooltech Xtool AnyScan Android Application (version 4.40.40 and prior ) is vulnerable to a Man-in-the-Middle (MITM) attack due to Missing SSL Certificate Validation . The application fails to properly validate the TLS certificate from its update server, allowing an attacker on the same netwo...

CVE-2025-63432

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle MITM attack ...

PT-2025-47946

Name of the Vulnerable Software and Affected Versions Xtooltech Xtool AnyScan Android Application versions 4.40.40 and prior Description The Xtooltech Xtool AnyScan Android Application does not properly validate TLS certificates from its update server. This allows an attacker on the same network ...

CVE-2025-63433

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt,...

CVE-2025-65102

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio...

CVE-2025-66098

creationtimestamp| type| source ---|---|--- 2025-11-21 14:28:53+00:00| seen| https://gist.github.com/Darkcrai86/b3d34d03dabeae207956865bc2141a58 2025-11-21 15:23:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m65lmlhcng2q...

CVE-2025-11127: Undefined Security Weakness

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address...

WordPress plugin Mstoreapp Mobile App和Mstoreapp Mobile Multivendor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security...

Beyond Jailbreak: Unveiling Risks in LLM Applications Arising from Blurred Capability Boundaries

LLM applications i.e., LLM apps leverage the powerful capabilities of LLMs to provide users with customized services, revolutionizing traditional application development. While the increasing prevalence of LLM-powered applications provides users with unprecedented convenience, it also brings fort...

CVE-2025-64185

creationtimestamp| type| source ---|---|--- 2025-11-20 19:54:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63kchavjk2s...

CVE-2025-63889

creationtimestamp| type| source ---|---|--- 2025-11-20 19:49:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63jziszqn2q...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of confidentiality [CVE-2025-1993]

Summary IBM App Connect Enterprise Certified Container DesignerAuthoring instances store their flows in a database that is protected by weaker than expected cryptographic algorithms that could be decrypted by a local user. This bulletin provides patch information to address the vulnerability in I...

CVE-2025-12778

creationtimestamp| type| source ---|---|--- 2025-11-20 08:04:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m62cndqlmn2q...

CVE-2025-13424

creationtimestamp| type| source ---|---|--- 2025-11-20 04:41:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5zxcbyj6x2w...

CVE-2025-13422

creationtimestamp| type| source ---|---|--- 2025-11-20 00:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5zij6gvgk2k...

KLA90450 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Application Gateway can be exploited remotely to gain privileges. 2. An elevatio...