About the security content of iOS 26.1 and iPadOS 26.1

About the security content of iOS 26.1 and iPadOS 26.1 This document describes the security content of iOS 26.1 and iPadOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Spyware-Plugged ChatGPT, DALL·E and WhatsApp Apps Target US Users

Are you using a fake version of a popular app? Appknox warns US users about malicious brand clones hiding on third-party app stores. Protect yourself from hidden spyware and ‘commercial parasites.’...

8 Best Password Managers (2025), Tested and Reviewed

Keep your logins locked down with our favorite password management apps for PC, Mac, Android, iPhone, and web browsers...

[SECURITY] Fedora 42 Update: qt6-qtwebview-6.9.3-1.fc42

Qt WebView provides a way to display web content in a QML application without necessarily including a full web browser stack by using native APIs where it makes sense...

[SECURITY] Fedora 42 Update: dtk6log-0.0.2-13.fc42

Simple, convenient and thread safe logger for Qt-based C++ apps...

CVE-2025-1038

The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute sever...

PT-2025-44154

Name of the Vulnerable Software and Affected Versions TropOS 4th Gen affected versions not specified Description The “Diagnostics Tools” page within the web-based configuration utility does not adequately validate user-supplied input. This allows a user with high-level authentication to inject...

Linux Distros Unpatched Vulnerability : CVE-2025-11716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Links in a sandboxed iframe could open an external app on Android without the required allow- permission. This vulnerability was fixed in Firefox 144 and...

PT-2025-43751

New Ubiquiti UniFi AP vuln CVE-2025-51234 exposes SSIDs to eavesdropping—disclosed today by Tenable. Update your wireless gear or risk WiFi wardriving pros. Thick client twist: Same flaw hits desktop apps. Network lockdown tips? CyberSecurity Exploits InfoSec infosecurity https://t.co/qSiZQgxNMM...

CVE-2025-12216

CVE-2025-12216 affects Azure Access Technology BLU-IC2 and BLU-IC4 (through version 1.19.5). The vulnerability arises from a malicious or malformed App that can be installed but not uninstalled, potentially causing service unavailability. Affected products are BLU-IC2 and BLU-IC4; impact is denia...

CVE-2025-12028

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the loginformindieauth function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for...

CVE-2025-12028 IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the loginformindieauth function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for...

The Geomys Standard of Care

One of the most impactful effects of professionalizing open source maintenance is that as professionals we can invest into upholding a set of standards that make our projects safer and more reliable. The same commitments and overhead that are often objected to when required of volunteers should b...

PT-2025-43496

Name of the Vulnerable Software and Affected Versions ContentProvider.java affected versions not specified Description An application with read-only access may be able to truncate files due to a logic error in the code within multiple functions of ContentProvider.java. This could lead to local...

DEBIAN-CVE-2025-53066

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle...

Evaluating Large Language Models in Detecting Secrets in Android Apps

Mobile apps often embed authentication secrets, such as API keys, tokens, and client IDs, to integrate with cloud services. However, developers often hardcode these credentials into Android apps, exposing them to extraction through reverse engineering. Once compromised, adversaries can exploit...

SUSE CVE-2025-11716

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144...

CVE-2025-58426

The CVE concerns desknet’s NEO across versions V4.0R1.0–V9.0R2.0, where a hard-coded cryptographic key enables an attacker to create malicious AppSuite applications. This is the underlying root cause described in multiple connected sources, with impact stated as attacker-authored AppSuite apps be...

CVE-2025-58079

Improper Protection of Alternate Path CWE-424 in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications...

Desknets Neo 安全漏洞

Desknets Neo is a remote office support software from Desknets Japan. A security vulnerability exists in Desknets Neo versions V4.0R1.0 through V9.0R2.0, which stems from the use of a hard-coded encryption key, which could allow an attacker to create a malicious AppSuite application...