Linux Distros Unpatched Vulnerability : CVE-2024-21138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2017-5074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a craft...

Linux Distros Unpatched Vulnerability : CVE-2022-21496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracl...

Linux Distros Unpatched Vulnerability : CVE-2021-35603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE:...

ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js

A cross-site scripting XSS issue exists in ExpressGateway ≤ 1.16.10 in lib/rest/routes/apps.js. User-controlled data returned by the REST endpoint is not sanitized before being rendered by the admin/UI layer, allowing an authenticated, low-privileged actor to store or reflect a payload that...

Linux Distros Unpatched Vulnerability : CVE-2024-26142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatc...

Linux Distros Unpatched Vulnerability : CVE-2017-5062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to...

Cross-site Scripting (XSS)

Overview express-gateway is an A microservices API gateway built on top of ExpressJS Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /users/:id and /apps/:id routes, where unsanitized user-supplied input req.params.id is directly embedded into the server's...

CVE-2025-9096 ExpressGateway express-gateway REST Endpoint apps.js cross site scripting

A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure

Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators' infrastructure. "The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft...

AUTOVR: Automated UI Exploration for Detecting Sensitive Data Flow Exposures in Virtual Reality Apps

The rise of Virtual Reality VR has provided developers with an unprecedented platform for creating games and applications apps that require distinct inputs, different from those of conventional devices like smartphones. The Meta Quest VR platform, driven by Meta, has democratized VR app publishin...

Malicious code in tapioca-frontend-apps (npm)

The package tapioca-frontend-apps was found to contain malicious code...

Malicious code in click-apps-library (npm)

The package click-apps-library was found to contain malicious code...

Malicious code in @epc-apps/api-version-test (npm)

The package @epc-apps/api-version-test was found to contain malicious code...

Malicious code in apps-script-oauth2 (npm)

The package apps-script-oauth2 was found to contain malicious code...

MAL-2025-7835 Malicious code in @epc-apps/api-version-test (npm)

The package @epc-apps/api-version-test was found to contain malicious code...

MAL-2025-34552 Malicious code in tapioca-frontend-apps (npm)

The package tapioca-frontend-apps was found to contain malicious code...

MAL-2025-17121 Malicious code in click-apps-library (npm)

The package click-apps-library was found to contain malicious code...

MAL-2025-14738 Malicious code in apps-script-oauth2 (npm)

The package apps-script-oauth2 was found to contain malicious code...

CVE-2025-50861

The Lotus Cars Android app com.lotus.carsdomestic.intl 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse...