Contacts search allowed users to retrieve contact information of other users beyond their contact list

None...

Stored XSS in contacts app via organisation and title field

None...

PT-2025-49300

Name of the Vulnerable Software and Affected Versions Nextcloud Contacts app versions prior to 5.5.4 Nextcloud Contacts app versions prior to 6.0.6 Nextcloud Contacts app versions prior to 7.2.5 Description A malicious user could modify the organisation and title fields to load additional CSS...

Malicious code in elf-stats-sleighing-mailbag-109 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 806052778d7970e94c40824de58ddfca3790e62ea9587441287268b8aff307d7 The package elf-stats-sleighing-mailbag-109 was found to contain malicious code. Source: ossf-package-analysis...

[SECURITY] Fedora 41 Update: nextcloud-32.0.2-1.fc41

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

[SECURITY] Fedora 43 Update: nextcloud-32.0.2-1.fc43

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

📄 WhatsApp Android Contact Gating Bypass

WhatsApp Android has a contact gating bypass in groups that leads to interaction-less media download. Background To prevent security issues and spam, WhatsApp for Android requires some form of user interaction to automatically download files from non-contacts: a. After adding someone as a contact...

Coupang Data Breach Affects All 33.7 Million South Korean Accounts

Coupang confirms a data breach affecting 33.7 million users in South Korea, exposing names, contacts and order details. Investigation is ongoing...

Synology Contacts for DSM 跨站脚本漏洞

Synology Contacts for DSM is a contact server provided by the Chinese company Synology. There is a security vulnerability in Synology Contacts for DSM, which allows attackers to bypass access restrictions and read or modify files...

EUVD-2025-150409

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uscesexport' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials ex...

MAL-2025-49453 Malicious code in karemv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9be53d7d069f1115ab0b8be4e3243af9ffb512d8a6dc0e31b5395852b1cbc3cd The package karemv1 was found to contain malicious code. Source: ghsa-malware 3f4cd13aca826d2f26c0f7927f298a62ee3f5a66fcc8567eff78027b93a02144 Any...

CVE-2025-43408

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen...

CVE-2025-43408

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen...

CVE-2025-43408

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen...

CVE-2025-43408

This CVE affects macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1. Root cause: an under‑restricted lock device option allowed a physically present attacker to access contacts from the lock screen. The issue is fixed in the listed updates. Remediation: upgrade to macOS Sonoma 14.8.2...

CVE-2025-43408

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An attacker with physical access may be able to access contacts from the lock screen...

PT-2025-44849

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An attacker with physical access may be able to access contacts from the lock screen. The issue was addressed by restricting options offered on a locked...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS Sonoma prior to 14.8.2 and Sequoia prior to 15.7.2, which stems from an under-restricted lock device option that could...

Insecure Direct Object Reference (IDOR)

Liferay Portal including Liferay DXP is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to the Contacts Center widget directly exposing the comliferaycontactswebportletContactsCenterPortletentryId parameter without proper authorization checks. An attackers can use...

PT-2025-43475

In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...