CVE-2026-21053

Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox...

SUSE CVE-2026-15115

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-51119

A privilege escalation vulnerability exists in Invixium IXM WEB v.2.3.85.25 due to a lack of server-side authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated user with low privileges can exploit this flaw to create a new administrator account, granting them full ...

CVE-2026-51119

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

CVE-2026-4653

creationtimestamp| type| source ---|---|--- 2026-07-09 23:07:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqs2htoe2y 2026-07-09 23:07:28+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaqs2m7yb27...

CVE-2026-55604

creationtimestamp| type| source ---|---|--- 2026-07-09 22:37:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqap3r6pk42e 2026-07-10 05:01:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbeluswmw2a 2026-08-25 20:35:12+00:00| published-proof-of-concept|...

CVE-2026-12170

creationtimestamp| type| source ---|---|--- 2026-07-09 22:30:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaop7hjtu2i...

MAL-2026-10096 Malicious code in guest-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5244faa59fb08eaa6dec10250fe2218a4909cb06ecc6ac972fda38b144f2aaef Package publishes as version 99.0.0 under a name presented in its README as an unclaimed internal name, positioning it to win dependency-confusion...

Malicious code in guest-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5244faa59fb08eaa6dec10250fe2218a4909cb06ecc6ac972fda38b144f2aaef Package publishes as version 99.0.0 under a name presented in its README as an unclaimed internal name, positioning it to win dependency-confusion...

CVE-2026-59734

creationtimestamp| type| source ---|---|--- 2026-07-09 18:47:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqacbssmiz2z 2026-07-13 22:00:04+00:00| seen| https://t.me/GithubRedTeam/92945 2026-07-14 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92945...

CVE-2026-13462

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

CVE-2026-13461

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

CVE-2026-13462

The PayRange Android app (version 7.0.7 and below ) contains an SSL bypass vulnerability in its application webviews. The flaw allows the app to bypass Android's SSL trust chain by accepting invalid certificates that match specific rules, such as Common Names ending with "payrange.com", containin...

CVE-2026-13462 PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

EUVD-2026-42637

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

CVE-2026-13461

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

EUVD-2026-42635

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device...

Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

deeplabcut (>=2.0.0.dev2, <=2.1.8), deeplabcutcore (>=0.0.0b1, <=0.0.0b3) +8 more potentially affected by CVE-2019-19624 via opencv-python (3.4.17.61)

opencv-python PYPI version 3.4.17.61 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - deeplabcut =2.0.0.dev2, =0.0.0b1, =2.1.1, =0.8.3, =0.3.0, =0.3.0, =3.0.5, =0.1.0a2, =0.1.0a7 Source cves: CVE-2019-19624 Source...

deeplabcut (>=2.0.0.dev2, <=2.1.8), deeplabcutcore (>=0.0.0b1, <=0.0.0b3) +8 more potentially affected by CVE-2019-14493 via opencv-python (3.4.17.61)

opencv-python PYPI version 3.4.17.61 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - deeplabcut =2.0.0.dev2, =0.0.0b1, =2.1.1, =0.8.3, =0.3.0, =0.3.0, =3.0.5, =0.1.0a2, =0.1.0a7 Source cves: CVE-2019-14493 Source...