EUVD-2025-19065

Malicious code in bioql PyPI...

CVE-2025-52883

Meshtastic-Android prior to version 2.5.21 is vulnerable: an attacker can send an unencrypted direct message impersonating another node, which is displayed in the victim’s chat as PKC-secured due to a forged green padlock. The victim may trust and read the attacker’s message as legitimate. Versio...

PT-2025-26783 · Unknown · Meshtastic-Android

Name of the Vulnerable Software and Affected Versions: Meshtastic-Android versions prior to 2.5.21 Description: The issue allows an attacker to send an unencrypted direct message to a victim, impersonating any other node of the mesh. This message will be displayed in the same chat that the victim...

CVE-2021-30478

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the canforgesender permission previously isapisuperuser resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same...

CVE-2025-24903

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user...

Message Impersonation

Matrix SDK is vulnerable to message impersonation. An attacker with a malicious homeserver can construct messages appearing to have come from a specific person...

CVE-2022-39257

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this m...

WordPress plugin Sensei LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2014-5376

Moab Authentication Bypass (CVE-2014-5376): Moab before 7.2.9 and 8 before 8.0.0 can sign messages with a pre-generated key, bypassing validation that the signing user matches the actor in the message. This allows remote authenticated users to impersonate arbitrary users via the actor field, enab...