CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting vulnerability

Authenticated Subscriber+ Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam in WordPress Plugin Redux Framework versions = 4.5.13...

[SECURITY] Fedora 45 Update: xmms2-0.9.7-8.fc45

XMMS2 is an audio framework, but it is not a general multimedia player - it will not play videos. It has a modular framework and plugin architecture for audio processing, visualisation and output, but this framework has not been designed to support video. Also the client-server design of XMMS2 an...

[SECURITY] Fedora 45 Update: mlt-7.40.0-2.fc45

MLT is an open source multimedia framework, designed and developed for television broadcasting. It provides a toolkit for broadcasters, video editors,media players, transcoders, web streamers and many more types of applications. The functionality of the system is provided via an assortment of rea...

[SECURITY] Fedora 45 Update: kf6-kfilemetadata-6.30.0-2.fc45

A Tier 2 KDE Framework for extracting file metadata...

Unlocking Cross-Scenario Physical Layer Security: A Mixture-Of-Experts Framework with Generative Diffusion Models

The future 6G networks are expected to incorporate a proliferation of wireless services in diverse environments, which presents a significant challenge for information security. Conventionally optimization always requires recalculation and learning strategy often suffers poor generalization, whic...

PT-2026-96935

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTP CLIENT IP and HTTP X FORWARDED FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout...

Spring Framework Unsafe Deserialization via Jackson JMS Converters

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

SR-Fraud: An Outcome-Supervised Reflective LLM Agent Framework for Non-Stationary Payment Fraud Detection

Real-time payment fraud detection is a non-stationary streaming prediction problem: adversaries adapt before supervised labels mature, and localized burst attacks can cause losses before retraining. Production systems typically rely on tabular classifiers and rules, which can struggle to capture...

CVE-2026-59282

A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service DoS attack. A remote attacker could exploit this by providing specially crafted input, leading to...

CVE-2025-71421

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71419

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...

CVE-2025-71420

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...

EUVD-2025-210977

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...