CVE-2025-27599

Element X Android (Element X Android apps by element.io) is affected prior to version 25.04.2. A crafted hyperlink on a webpage or a locally installed malicious app can cause Element X up to 25.04.1 to load a webpage with permissions similar to Element Call and automatically grant temporary acces...

CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-3106

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3106

CVE-2025-3106 affects LA-Studio Element Kit for Elementor (WordPress) up to version 1.4.9, enabling Stored Cross-Site Scripting via the Table of Contents widget when a contributor+ user supplies crafted attributes. Root cause: insufficient input sanitization and output escaping on user-provided a...

CVE-2025-3106 LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2025-17307 · Element · Element

Name of the Vulnerable Software and Affected Versions: Element X Android versions prior to 25.04.2 Description: A crafted hyperlink on a webpage or a locally installed malicious app can force Element X to load a webpage with similar permissions to Element Call, automatically granting it temporary...

Element X Android 安全漏洞

Element X Android is an Android Matrix application from Element open source using Matrix Rust Sdk and Jetpack Compose. A security vulnerability exists in Element X Android versions prior to 25.04.2, which stems from a specially crafted hyperlink that could result in automatically granting tempora...

PT-2025-17290 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Table of Contents widget due to insufficient input sanitization an...

kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the...

Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3217 Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3218 Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Power Automate 安全漏洞

Microsoft Power Automate is a low-code automation platform from Microsoft Corporation USA that allows users to create automated workflows that connect and integrate various applications and services. A security vulnerability exists in Microsoft Power Automate that stems from insufficient control...

CVE-2025-1782

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated...

CVE-2025-32026

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

SUSE CVE-2025-32026

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...

CVE-2025-21435

Transient DOS may occur while parsing extended IE in beacon...

The vulnerability of the Microsoft Visual Studio software development tool, related to an uncontrolled search path element, allows a hacker to escalate their privileges.

The vulnerability of the Microsoft Visual Studio software development tool is related to an uncontrollable element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2025-32026

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used f...