How to Keep Your Voice Recordings Private on iPhone

What did you last record on your iPhone? A lecture, perhaps, a call with your landlord, or notes…...

openmeetings-invite-recording-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-invite-recording-acl Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-invite-recording-acl Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0. CVE-2023-29032 stopped...

RUSTSEC-2026-0412 Arbitrary code execution when rerunning tests from a portable recording

Summary Nextest versions between 0.9.125 and 0.9.149 inclusive allow the cargo nextest run --rerun or -R command with a malicious portable recording to run arbitrary code during the build. The result is arbitrary code execution with the privileges of the user running cargo nextest. This...

CVE-2026-95686

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

PT-2026-109647

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 5.6.6 Description An OS command injection issue exists in the call recordings::download function. Unauthenticated attackers can execute commands as the web server user by placing calls with malicious caller ID value...

PT-2026-96220

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The api get recording stream function in warpgate-admin/src/api/recordings detail.rs fails to enforce the AdminPermission::RecordingsView requirement for the...

Malicious code in minecraft-ytreceiver (PyPI)

Source: kam193 af6c2393210af3735a9353f40789859af7f87c96bcbd00178df62edb2ff7175e The package hides code for exfiltrating files, recordings from the webcam, screenshots, keylogging. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2026-53452

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it...

FreePBX ARI - Cookie Auth Bypass Detection (CVE-2014-7235)

Detects CVE-2014-7235 by sending crafted ariauth cookie to /recordings/index.php and matching authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX ARI recordings auth bypass CVE-2014-7235.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

pocumentary

An open-source project from Pillar Security PoCumentary T...

Robocalls: A Worldwide or US-Only Problem? Analyzing Spam and Fraud in International Phone Calls

Unsolicited automated phone calls robocalls are a serious threat: in the US alone, these calls resulted in reported losses of 1.1$ billion during 2025. Phishing and spoofing consistently rank among the most reported crimes within the FBI's Internet Crime Complaint Center, with phone call scams...

pytest-elements (>=0.8.0, <=1.0.2), pytest-recordings (>=0.3.0, <=0.4.2) +1 more potentially affected by unknown CVE via vcrpy (4.0.2)

vcrpy PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on vcrpy and may be impacted: - pytest-elements =0.8.0, =0.3.0, =0.4.2 - pywiw 0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-RPJ2-4HQ8-938G...

CVE-2026-49202

Technical details are not publicly available in the provided documents; monitor for updates.

EUVD-2026-30811

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback presentation format was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording...

CVE-2026-27737 BigBlueButton has Stored XSS in bbb-playback replay

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback presentation format was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording...

Company that Secretly Records and Publishes Zoom Meetings

WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes alternate link the recordings. It doesn't use the Zoom record feature, so Zoom can't do anything about it...

PT-2026-27190

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo is an open source video platform. The standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php accepts a user-supplied streamerURL parameter that allows...

ShinyHunters Claims 1 Petabyte Data Theft from Telecom Giant Telus

ShinyHunters claims it stole up to 1 petabyte of data from Telus Digital, including support recordings, code, and employee records after a breach...

CVE-2026-28287

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5...

CVE-2026-28209

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech TTS engine in the recordings module. This issue has been patched in versions 16.0.20...