CVE-2025-42620: Improper Neutralization of Input During Web Page Generation

In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting XSS. On the backend, the relatedvulnerabilities field of bundles accepted arbitrary strings without format validation or proper...

CVE-2025-48566: Improper Input Validation

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48580: Undefined Security Weakness

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-48596: Out-of-bounds Read

In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48607: Undefined Security Weakness

In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48621: Initialization of a Resource with an Insecure Default

In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2025-48622: Out-of-bounds Read

In ProcessArea of dngmiscopcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-58279: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-66320: Concurrent Execution using Shared Resource with Improper Synchronization

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66326: Use After Free

Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66329: Undefined Security Weakness

Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66322: Concurrent Execution using Shared Resource with Improper Synchronization

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66323: Improperly Implemented Security Check for Standard

Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66324: Improper Privilege Management

Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity...

CVE-2025-66325: Undefined Security Weakness

Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-66328: Concurrent Execution using Shared Resource with Improper Synchronization

Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-66334: Download of Code Without Integrity Check

Denial of service DoS vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-48594: Improper Input Validation

In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed...

CVE-2025-22432: Improper Input Validation

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-65799: External Control of File Name or Path

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal...