About the security content of iOS 26.1 and iPadOS 26.1

About the security content of iOS 26.1 and iPadOS 26.1 This document describes the security content of iOS 26.1 and iPadOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Spyware-Plugged ChatGPT, DALL·E and WhatsApp Apps Target US Users

Are you using a fake version of a popular app? Appknox warns US users about malicious brand clones hiding on third-party app stores. Protect yourself from hidden spyware and ‘commercial parasites.’...

[SECURITY] Fedora 42 Update: qt6-qtwebview-6.9.3-1.fc42

Qt WebView provides a way to display web content in a QML application without necessarily including a full web browser stack by using native APIs where it makes sense...

[SECURITY] Fedora 42 Update: dtk6log-0.0.2-13.fc42

Simple, convenient and thread safe logger for Qt-based C++ apps...

CVE-2025-1038

The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute sever...

PT-2025-44154

Name of the Vulnerable Software and Affected Versions TropOS 4th Gen affected versions not specified Description The “Diagnostics Tools” page within the web-based configuration utility does not adequately validate user-supplied input. This allows a user with high-level authentication to inject...

Linux Distros Unpatched Vulnerability : CVE-2025-11716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Links in a sandboxed iframe could open an external app on Android without the required allow- permission. This vulnerability was fixed in Firefox 144 and...

PT-2025-43751

New Ubiquiti UniFi AP vuln CVE-2025-51234 exposes SSIDs to eavesdropping—disclosed today by Tenable. Update your wireless gear or risk WiFi wardriving pros. Thick client twist: Same flaw hits desktop apps. Network lockdown tips? CyberSecurity Exploits InfoSec infosecurity https://t.co/qSiZQgxNMM...

CVE-2025-12216

CVE-2025-12216 affects Azure Access Technology BLU-IC2 and BLU-IC4 (through version 1.19.5). The vulnerability arises from a malicious or malformed App that can be installed but not uninstalled, potentially causing service unavailability. Affected products are BLU-IC2 and BLU-IC4; impact is denia...

CVE-2025-12028

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the loginformindieauth function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for...

CVE-2025-12028 IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the loginformindieauth function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for...

The Geomys Standard of Care

One of the most impactful effects of professionalizing open source maintenance is that as professionals we can invest into upholding a set of standards that make our projects safer and more reliable. The same commitments and overhead that are often objected to when required of volunteers should b...

PT-2025-43496

Name of the Vulnerable Software and Affected Versions ContentProvider.java affected versions not specified Description An application with read-only access may be able to truncate files due to a logic error in the code within multiple functions of ContentProvider.java. This could lead to local...

DEBIAN-CVE-2025-53066

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle...

Evaluating Large Language Models in Detecting Secrets in Android Apps

Mobile apps often embed authentication secrets, such as API keys, tokens, and client IDs, to integrate with cloud services. However, developers often hardcode these credentials into Android apps, exposing them to extraction through reverse engineering. Once compromised, adversaries can exploit...

The vulnerability of Microsoft Office and 365 Apps for Enterprise applications relates to the possibility of exploiting memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages relates to reading data beyond the buffer in memory, allowing an attacker to disclose protected information.

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these security measures...

The vulnerability of Microsoft Office packages, Word, and 365 Apps for Enterprise lies in the possibility of exploiting memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages, Word, and 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Vulnerability of Microsoft Office packages, 365 Apps for Enterprise, and Microsoft PowerPoint presentation preparation programs, related to memory usage after its release, allowing attackers to execute arbitrary code.

Vulnerabilities of Microsoft Office packages, 365 Apps for Enterprise, and Microsoft PowerPoint presentation software are related to the use of memory after it is released. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

The vulnerability of Microsoft Office packages, Word, and 365 Apps for Enterprise lies in the possibility of exploiting memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages, Word, and 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...