EUVD-2025-34719

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment...

EUVD-2025-34718

Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment...

CVE-2025-62583

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment...

CVE-2025-62585

Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment...

CVE-2025-62585

CVE-2025-62585 affects Whale Browser prior to 4.33.325.17. The vulnerability allows bypassing the Content Security Policy via a specific scheme in a dual-tab environment. Root cause details are not expanded beyond the CSP bypass mechanism in the provided documents. Affected component is the brows...

CVE-2025-62584

Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment...

CVE-2025-62584

CVE-2025-62584 affects Naver Whale Browser prior to version 4.33.325.17 and describes a bypass of the Same-Origin Policy in a dual-tab environment. The available connected documents consistently state that the issue enables an attacker to bypass SOP between tabs, but they do not provide concrete ...

Improper Configuration Management

TinyEnv is vulnerable to Improper Configuration Management. The vulnerability is due to the application not requiring the .env file to exist when loading environment variables, which allows an attacker or misconfiguration to cause the application to run with insecure defaults or missing...

PT-2025-42472

Name of the Vulnerable Software and Affected Versions Spring Cloud Gateway Server Webflux affected versions not specified Description Spring Cloud Gateway Server Webflux is susceptible to a SpEL Spring Expression Language injection issue. This flaw allows unauthenticated attackers to access...

LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?

Large language model LLM agents have demonstrated remarkable capabilities in software engineering and cybersecurity tasks, including code generation, vulnerability discovery, and automated testing. One critical but underexplored application is automated web vulnerability reproduction, which...

Spring Cloud Gateway Server Webflux 安全漏洞

Spring Cloud Gateway Server Webflux is a Spring open source gateway server. A security vulnerability exists in Spring Cloud Gateway Server Webflux that stems from the Spring Expression Language that may expose environment variables and system properties, potentially leading to information...

ROS-20251016-03

A vulnerability in the FirmwarePerformancePei.c component of the UEFI EDK2 open source development environment is related to the lack of division by zero check. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Naver Whale Browser 安全漏洞

Naver Whale Browser is a web browser from Naver, a South Korean company that supports user-defined interfaces. A security vulnerability exists in Naver Whale Browser versions prior to 4.33.325.17, which originates from an attacker being able to bypass the same-origin policy in a two-tab environme...

@happy-dom/global-registrator (>=19.0.0, <=19.0.2), @happy-dom/jest-environment (>=19.0.0, <=19.0.2) +4 more potentially affected by CVE-2025-62410 via happy-dom (>=19.0.2, <=20.0.0)

happy-dom NPM version =19.0.2, =19.0.0, =19.0.0, =19.0.0, =1.0.0, =0.1.9, =1.1.81, =1.1.82 Source cves: CVE-2025-62410 Source advisory: OSV:GHSA-QPM2-6CQ5-7PQ5...

GHSA-RFH5-C9H5-Q8JM reflex-dev/reflex has an Open Redirect vulnerability

Mitigation Make sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct: assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description --- Vulnerability Overview - When the GET /auth-codespace page loads in a GitHub...

reflex-dev/reflex has an Open Redirect vulnerability

Mitigation Make sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct: assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description --- Vulnerability Overview - When the GET /auth-codespace page loads in a GitHub...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379

Reflex (Python web app framework) versions 0.5.4–0.8.14 contain an Open Redirect in the /auth-codespace route: the redirect_to query parameter is assigned directly to client-side links without validation, triggering automatic navigation, which can redirect users to arbitrary external URLs. The vu...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...