Malicious code in kssd-vol4-debug-app (npm)

The package kssd-vol4-debug-app was found to contain malicious code...

Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

MAL-2025-46117 Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

MAL-2025-42191 Malicious code in @bugtestester/simple-web-app-package (npm)

The package @bugtestester/simple-web-app-package was found to contain malicious code...

MAL-2025-42963 Malicious code in @tobiasredfield/simple-web-app-package (npm)

The package @tobiasredfield/simple-web-app-package was found to contain malicious code...

Malicious code in spark-nextjs-app (npm)

The package spark-nextjs-app was found to contain malicious code...

Malicious code in @tobiasredfield/simple-web-app-package (npm)

The package @tobiasredfield/simple-web-app-package was found to contain malicious code...

MAL-2025-46116 Malicious code in spark-nextjs-app (npm)

The package spark-nextjs-app was found to contain malicious code...

CVE-2025-32317

CVE-2025-32317 affects the Android App Widget, where a confused deputy leads to a local information disclosure without extra privileges or user interaction. The issue is categorized as Information Disclosure (CVE type) with a CVSSv3.1 base score of 5.5 (Medium) and a Local attack vector with Conf...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26461

In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction...

CVE-2025-57807

creationtimestamp| type| source ---|---|--- 2025-09-05 09:23:40+00:00| published-proof-of-concept| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg 2025-09-05 23:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ly4tavtmx42t 2025-09-08...

"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly

Overview "Yahoo! Shopping" App for Android provided by LY Corporation contains the following vulnerability. Improper authorization in handler for custom URL scheme CWE-939 - CVE-2025-41408 Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

CVE-2025-41408

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attac...

CVE-2025-56139

LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata image, title, description when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different UR...

LY Yahoo! Shopping App 安全漏洞

LY Yahoo! Shopping App is a shopping mobile application from LY Japan. A security vulnerability exists in LY Yahoo! Shopping App versions prior to 14.15.0, which stems from improper handling of the custom URL scheme and could lead to users becoming victims of phishing attacks...

PT-2025-36110

Name of the Vulnerable Software and Affected Versions: Yahoo! Shopping App for Android versions prior to 14.15.0 Description: Improper authorization in the handler for a custom URL scheme in the Yahoo! Shopping App for Android may allow a remote, unauthenticated attacker to redirect a user to an...

PT-2025-36237

Name of the Vulnerable Software and Affected Versions: Permission Manager affected versions not specified Description: In Permission Manager, the microphone privacy indicator may remain activated even after a user attempts to close the application. This is due to a logic error in the code and cou...

PT-2025-36239

Name of the Vulnerable Software and Affected Versions: App Widget affected versions not specified Description: An information disclosure issue exists in App Widget due to a confused deputy condition. This could result in local information disclosure without requiring additional execution privileg...