CVE-2025-41459 Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS

Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection...

CVE-2025-41458 Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS

Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem...

CVE-2025-41458 Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS

Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem...

CVE-2025-4569

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...

CVE-2025-4570

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...

CVE-2025-4570

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...

CVE-2025-7916

WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents...

CVE-2025-7916

WinMatrix3 by Simopro Technology is affected by CVE-2025-7916: an insecure deserialization vulnerability that allows unauthenticated remote code execution via crafted serialized content. The issue stems from unsafe deserialization within the server component, enabling arbitrary code execution on ...

CVE-2025-7916 Simopro Technology｜WinMatrix3 - Insecure Deserialization

WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents...

CVE-2025-7916 Simopro Technology｜WinMatrix3 - Insecure Deserialization

WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

PT-2025-30344 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAXcms versions prior to 11.0.7 Description: HAXcms with a nodejs backend allows users to start the server in any HAXsite or HAXcms instance. The NodeJS version of HAXcms, in versions 11.0.6 and below, uses an insecure default configuration...

ASUS MyASUS 安全漏洞

ASUS MyASUS is an official ASUS PC application from Asus China Inc. A security vulnerability exists in ASUS MyASUS that stems from insecure storage of sensitive keys, which could lead to unauthorized participants obtaining a token...

PT-2025-30229 · Simopro Technology · Winmatrix3

Name of the Vulnerable Software and Affected Versions: WinMatrix3 affected versions not specified Description: WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability. This allows unauthenticated remote attackers to execute arbitrary code on the server by sending...

GPT-SoVITS-WebUI code issue vulnerability (CNVD-2025-23576)

GPT-SoVITS-WebUI is a TTS training model. A code issue vulnerability exists in GPT-SoVITS-WebUI, which stems from insecure deserialization of bsroformer.py when receiving serialized data submitted by a user, and can be exploited by an attacker to execute arbitrary commands on the system...

PT-2025-30339 · Dippy · Dippy

Name of the Vulnerable Software and Affected Versions: Dippy version 2 Description: An Insecure Direct Object Reference IDOR vulnerability exists in Dippy that allows attackers to gain sensitive information. The vulnerability is present in the conversation history API endpoint and is exploitable...

ChatPlayground.ai Cross Site Scripting / Insecure Direct Object Reference

ChatPlayground.ai is a popular web application for comparing AI models. A cross site scripting vulnerability exists in the chat component. This can lead to JWT token theft and remote account hijacking. Additionally, the /api/chat-history endpoint exhibits weak access control allowing for insecure...

CVE-2025-51868

CVE-2025-51868 describes an Insecure Direct Object Reference (IDOR) in Dippy v2. An attacker can access sensitive information through the conversation_id parameter of the conversation_history endpoint, leading to disclosure of other users’ conversation histories. Affected: Dippy version 2 (chat.d...

PT-2025-30246 · Asus · Myasus

Name of the Vulnerable Software and Affected Versions: MyASUS affected versions not specified Description: An issue involving insecure storage of sensitive keys was identified in MyASUS. This could potentially allow an unauthorized actor to obtain a token used for communication with certain...