TeaOnHer, the male version of Tea, is leaking personal information on its users too

Last week we reported about some serious leaks in Tea Dating Advice, an app that provides a space for women to exchange information about men they know, have met, or have dated in the past. The app aims to provide a platform where people can share relevant information about, say, potentially...

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications. This vulnerability allows attackers to gain unauthorized access to protected information.

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications, exposes vulnerabilities related to access control for personal information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to...

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications. This vulnerability allows attackers to gain unauthorized access to protected information.

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications, exposes security flaws in access control for personal information. Exploiting this vulnerability could allow unauthorized actors to gain unauthorized access to...

CVE-2025-50870

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...

Spying on People Through Airportr Luggage Delivery Service

Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it's used by wealthy or important people. So if the company's website is insecure, you'd be able to spy on lots of wealthy or important people. And mayb...

PT-2025-31656 · Unknown · Institute-Of-Current-Students

Name of the Vulnerable Software and Affected Versions: Institute-of-Current-Students version 1.0 Description: The software is susceptible to Incorrect Access Control. The mydetailsstudent.php endpoint allows unauthorized access to student details. The myds GET parameter accepts an email address a...

Prison visitor details shared with all inmates at correctional facility

The Everglades Correctional Institution ECI in Miami-Dade County has leaked the names, email addresses, and telephone numbers of visitors to the facility to every inmate. The inmates received an email last week sent by a staff member that included the personal information of the visitors. Inmates...

iPhone vs. Android: iPhone users more reckless, less protected online

The smartphone wars have a winner, and it’s Android. No, this isn’t about which device has the best camera, the snappiest processor, or the flashiest AI features—this is about which device owners are safer online, and in many ways, it is Android users who take the crown. According to a new analys...

How the Solid Protocol Restores Digital Agency

The current state of digital identity is a mess. Your personal information is scattered across hundreds of locations: social media companies, IoT companies, government agencies, websites you have accounts on, and data brokers you've never heard of. These entities collect, store, and trade your...

CVE-2025-7371

CVE-2025-7371 affects Okta On-Premises Provisioning (OPP) agents. Data logging vulnerability exists in local OPP agent servers in versions 2.2.1–2.3.0, where administrator-initiated password resets cause the agent to log user personal information and temporary passwords. Affected scenario: an att...

Okta On-Premises Provisioning Agent 日志信息泄露漏洞

Okta On-Premises Provisioning Agent is a software from Okta USA that automates the creation, update and deletion of Otka user accounts in a local environment. A log information disclosure vulnerability exists in Okta On-Premises Provisioning Agent version 2.3.0 and prior versions, which originate...

PhishIntentionLLM: Uncovering Phishing Website Intentions through Multi-Agent Retrieval-Augmented Generation

Phishing websites remain a major cybersecurity threat, yet existing methods primarily focus on detection, while the recognition of underlying malicious intentions remains largely unexplored. To address this gap, we propose PhishIntentionLLM, a multi-agent retrieval-augmented generation RAG...

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald 's was exposed after they guessed the password "123456" for the fast food chain's account at Paradox.ai , a company that makes artificial intelligence based hiring chatbots...

UK Pet Owners Targeted by Fake Microchip Renewal Scams

Microchip renewal scam targets UK pet owners using leaked data from insecure registries. Emails appear legit but aim to steal money and personal info...

Exposure of Private Personal Information to an Unauthorized Actor

Overview universal-omega/dynamic-page-list3 is a The DynamicPageList3 extension allows creating lists of other articles based on their category, namespace, title, references or template usage and include contents or arguments of template calls of those articles into your page. Affected versions o...

McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...

CVE-2025-49715

Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network...

Fake bank ads on Instagram scam victims out of money

Ads on Instagram—including deepfake videos—are impersonating trusted financial institutions like Bank of Montreal BMO and EQ Bank Equitable Bank in order to scam people, according to BleepingComputer. There are some variations in how the scammers approach this. Some use Artificial Intelligence AI...