31696 matches found
PT-2025-39806
Name of the Vulnerable Software and Affected Versions mirweiye wenkucms versions up to 3.4 Description A flaw exists that allows for remote operating system command injection. This occurs due to manipulation of the createPathOne function within the app/common/common.php file. The exploit has been...
PT-2025-39852
Name of the Vulnerable Software and Affected Versions Payeer Android application version 2.5.0 Description An improper access control issue exists in the authentication process for changing the PIN in the Payeer Android application. A local attacker with root access to the device can bypass the P...
CVE-2025-11101
creationtimestamp| type| source ---|---|--- 2025-09-28 09:02:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzv55wtwkj2a...
CVE-2025-60173
creationtimestamp| type| source ---|---|--- 2025-09-28 07:32:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzuy56hfcj2i...
CVE-2025-60156
creationtimestamp| type| source ---|---|--- 2025-09-28 00:02:50+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzu6yorayg2k...
CVE-2025-60164
Cross-Site Request Forgery CSRF vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through = 2.7.7...
Neon App pays users to record their phone calls, sells data for AI training [updated]
TechCrunch reports about a “bizarre app” inviting you to record and share your audio calls so that it can sell the data to AI companies. And if that’s not weird enough on its own, it’s ranking No. 2 in Apple's US app store at the time of writing. The name of the app is Neon Mobile and it promises...
MAL-2025-47720 Malicious code in raas-client-app (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-47666 Malicious code in example-nestjs-api (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-47610 Malicious code in ai-communication-app (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ai-communication-app (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-60164
Cross-Site Request Forgery CSRF vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through = 2.7.7...
CVE-2025-10136
CVE-2025-10136 concerns the WordPress plugin TweetThis Shortcode. The TweetThis Shortcode plugin is vulnerable to Stored Cross-Site Scripting via its tweetthis shortcode in all versions up to and including 1.8.0 due to insufficient input sanitization and output escaping on user-supplied attribute...
Bridging Technical Capability and User Accessibility: Off-Grid Civilian Emergency Communication
During large-scale crises disrupting cellular and Internet infrastructure, civilians lack reliable methods for communication, aid coordination, and access to trustworthy information. This paper presents a unified emergency communication system integrating a low-power, long-range network with a...
CVE-2025-7106
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The checkAccess function in api/server/middleware/roles/access.js uses permissions.some to validate permissions, which incorrectly grants access if only one of multiple required...
Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution [CVE-2025-7783]
Summary Node.js module form-data is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution. This bulletin provides patch information to address the reported vulnerability in Node.js module form-dat...
CVE-2025-41715
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it...
Malicious Package
Overview @dropbox-photo-viewer/electron-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
MAL-2025-47523 Malicious code in @dropbox-photo-viewer/electron-app (npm)
The package @dropbox-photo-viewer/electron-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0e60f8bd38264b681d07237c310d98471fc7bfc1b9ab2bfabf4258bf01a9ea9 Any computer that has this package installed or running should be...