Spsoft APPLOCK 安全漏洞

Spsoft APPLOCK is a mobile app lock developed by Spsoft Corporation. It uses a password and fingerprint for securing applications. Version 7.9.40 of Spsoft AppLock contains a security vulnerability. This vulnerability arises from the inconsistent execution of authentication processes by the custo...

CVE-2025-68710

Easyelife App lock aka Fingerprint,Applock or locker.app.safe.applocker 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows -...

CVE-2025-68711

AppLockZ App Lock and Fingerprint Lock applock.passwordfingerprint.applockz 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface...

PT-2026-43394

Name of the Vulnerable Software and Affected Versions AppLockZ App Lock and Fingerprint Lock version 4.2.11 Description A local attacker with physical access can bypass the PIN lock because the lock is implemented as an overlay instead of using Android's secure authentication APIs. By navigating...

PT-2026-42007

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0 Description A heap buffer over-read exists in the HeifPixelImage::overlay function within libheif/pixelimage.cc. This occurs when compositing an overlay image where the child image uses a different bit depth fo...

EUVD-2026-30610

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse inside @html with an incorrect DOMPurify application order. An admi...

CVE-2022-50875

In the Linux kernel, the following vulnerability has been resolved: of: overlay: fix null pointer dereferencing in finddupcsetnodeentry and finddupcsetprop When kmalloc fail to allocate memory in kasprintf, fn1 or fn2 will be NULL, and strcmp will cause null pointer dereference...

CVE-2022-50875 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()

In the Linux kernel, the following vulnerability has been resolved: of: overlay: fix null pointer dereferencing in finddupcsetnodeentry and finddupcsetprop When kmalloc fail to allocate memory in kasprintf, fn1 or fn2 will be NULL, and strcmp will cause null pointer dereference...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the HeifPixelImage::overlay function. An attacker can cause a crash by supplying a crafted HEIF file with a malicious iovl overlay box that triggers a negative row length calculation, leading to a large...

Linux Distros Unpatched Vulnerability : CVE-2025-68431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap...

EUVD-2025-203850

An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-52582

An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability...

Grassroot DICOM Overlay::GrabOverlayFromPixelData out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2025-2211 Grassroot DICOM Overlay::GrabOverlayFromPixelData out-of-bounds read vulnerability December 16, 2025 CVE Number CVE-2025-52582 SUMMARY An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM...

EUVD-2021-27991

Malicious code in bioql PyPI...

@8sistemas/design-system (>=0.6.0 <=0.7.0), @adaptui/react-native-tailwind (>=1.0.0 <=1.0.0-alpha.13) +211 more potentially affected by unknown CVE via @react-native-aria/overlays (>=0.2.11 <=0.3.15)

@react-native-aria/overlays NPM version =0.2.11, =0.6.0, =1.0.0, =6.5.1-alpha.0, =1.0.1, =0.0.3, =0.1.21, =1.0.0, =0.5.0-alpha.2, =0.1.0-alpha2, =1.2.0, =0.1.0, =0.1.8 and more Source cves: unknown CVE Source advisory: OSV:MAL-2025-4785...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 128.5.0 ESR, fixed various security fixes and other quality improvements, MFSA 2024-64 bsc1233695: CVE-2024-11691: Memory corruption in Apple GPU drivers CVE-2024-11692: Select list elements could be shown...

Command injection

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...

CVE-2022-20007

In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges neede...

CVE-2021-1039

In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2021-40834

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack...