CVE-2025-27599

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-27599

Element X Android (Element X Android apps by element.io) is affected prior to version 25.04.2. A crafted hyperlink on a webpage or a locally installed malicious app can cause Element X up to 25.04.1 to load a webpage with permissions similar to Element Call and automatically grant temporary acces...

CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-27599

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-3106

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3106 LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3106

CVE-2025-3106 affects LA-Studio Element Kit for Elementor (WordPress) up to version 1.4.9, enabling Stored Cross-Site Scripting via the Table of Contents widget when a contributor+ user supplies crafted attributes. Root cause: insufficient input sanitization and output escaping on user-provided a...

Element X Android 安全漏洞

Element X Android is an Android Matrix application from Element open source using Matrix Rust Sdk and Jetpack Compose. A security vulnerability exists in Element X Android versions prior to 25.04.2, which stems from a specially crafted hyperlink that could result in automatically granting tempora...

PT-2025-17290 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Table of Contents widget due to insufficient input sanitization an...

CVE-2025-27599: Improper Export of Android Application Components

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it...

CVE-2025-3106: Improper Neutralization of Input During Web Page Generation

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2025-17307 · Element · Element

Name of the Vulnerable Software and Affected Versions: Element X Android versions prior to 25.04.2 Description: A crafted hyperlink on a webpage or a locally installed malicious app can force Element X to load a webpage with similar permissions to Element Call, automatically granting it temporary...

kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

A flaw was found in the Linux kernel. A race condition exists in the irqchip/gic-v4 component, where a local user can force a change of affinity for a Virtual Processing Element VPE after it has been unmapped. This occurs because the corresponding doorbell interrupt remains visible, creating a...

Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in element-ui-locale-en

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3217 Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3218 Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...