CVE-2025-12792

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

EUVD-2025-197904

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

CVE-2025-12792

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

CVE-2025-12792

CVE-2025-12792 describes a vulnerability in the Mac App Store distribution of the Canva for Mac desktop app prior to 1.117.1. The issue stems from the app being built without Hardened Runtime, enabling a local threat actor with unprivileged access to execute arbitrary code that inherits the app’s...

CVE-2025-55796

OpenML Frontend (openml.org) web app version v2.0.20241110 is affected by a token-generation flaw. Tokens used for signup confirmation, password resets, email confirmations/resends, and email changes are MD5-based and generated from the current timestamp (format "%d %H:%M:%S") without user-specif...

The vulnerability in the web application for managing phpMyAdmin, related to the lack of protective measures for the web page structure, allows a perpetrator to execute arbitrary code.

The vulnerability in the web application for managing phpMyAdmin is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2025-47233

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC Transparency, Consent, and Control permissions assigned to Canva...

CVE-2024-44655

creationtimestamp| type| source ---|---|--- 2025-11-17 21:59:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5u7vqhs2u2j...

CVE-2025-13216

creationtimestamp| type| source ---|---|--- 2025-11-17 21:27:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5u64b6jt32w...

CVE-2025-9317

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes...

CVE-2025-60022

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

EUVD-2025-197765

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

"Dejira" App for iOS vulnerable to improper server certificate verification

Overview "Dejira" App for iOS provided by KDDI CORPORATION contains the following vulnerability. Improper server certificate verification CWE-295 Tsuyoshi Ogawa of SIE Co.,Ltd reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2025-64753

creationtimestamp| type| source ---|---|--- 2025-11-14 01:08:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5killvrbz2q...

CVE-2025-47913

creationtimestamp| type| source ---|---|--- 2025-11-14 00:48:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5khhs7dz72q 2025-12-19 20:31:46+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3maejvl5q6w2q 2025-12-19 20:31:57+00:00| seen|...

PT-2025-47034

Name of the Vulnerable Software and Affected Versions Application Server affected versions not specified Description An authenticated attacker with “aaConfigTools” privilege can modify App Objects’ help files, potentially leading to a persistent cross-site scripting XSS injection. Successful...

GHSA-8JPW-GPR4-8CMH Directus's conceal fields are searchable if read permissions enabled

Summary A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked , successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Details The system permits sear...

@directus/api (31.0.0), directus (11.12.0) potentially affected by CVE-2025-64747 via @directus/app (14.0.0)

@directus/app NPM version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/app and may be impacted: - @directus/api 31.0.0 - directus 11.12.0 Source cves: CVE-2025-64747 Source advisory: SNYK:JS-DIRECTUSAPP-13985180...

Cross-site Scripting (XSS)

Overview @directus/app is an App dashboard for Directus Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Block Editor interface when users with upload files and edit item permissions inject malicious JavaScript. An attacker can execute arbitrary scripts in the...

CVE-2025-8485

An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application...