PT-2025-44847

Name of the Vulnerable Software and Affected Versions macOS versions prior to 14.8.2 macOS versions prior to 15.7.2 Description A permissions issue existed due to insufficient sandbox restrictions, potentially allowing an application to access user-sensitive data. Recommendations Update to macOS...

PT-2025-44856

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description A race condition existed due to improper state handling, potentially allowing an application to access sensitive user data. Recommendations Update to macO...

PT-2025-50984

Name of the Vulnerable Software and Affected Versions macOS versions prior to Tahoe 26.1 Description The software addresses an issue with improper handling of symlinks, which could allow a malicious application to delete protected user data. Recommendations Update to macOS Tahoe 26.1...

PT-2025-44862

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.1 iPadOS versions prior to 26.1 Description A flaw exists due to insufficient data redaction in logging mechanisms. This could allow an application to access sensitive user data. Recommendations Update to iOS version...

PT-2025-55371

Name of the Vulnerable Software and Affected Versions macOS Tahoe versions prior to 26.1 Description A permissions issue exists where an application may be able to access protected user data. This was addressed by implementing additional restrictions. Recommendations Update to macOS Tahoe 26.1...

CVE-2025-12460

An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window...

Improper Neutralization of Special Elements

Overview intugle is an A GenAI-powered Python library for building semantic layers. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements via user-supplied data. An attacker can execute arbitrary code by providing Pandas DataFrames that contain Python cod...

OESA-2025-2553 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all skuserdata reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receivi...

CVE-2025-61114

2nd Line Android App version v1.2.92 and before package name com.mysecondline.app, developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the usertoken, enabling attackers to brute force...

CVE-2025-61119

Kanova Android App version 1.0.27 package name com.karelane, developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful...

Client Details System update-clients.php file cross-site scripting vulnerability

Client Details System is a client information system. Client Details System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the file /update-clients.php, which can be exploited by an attacker to execute...

EUVD-2025-37029

2nd Line Android App version v1.2.92 and before package name com.mysecondline.app, developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the usertoken, enabling attackers to brute force...

EUVD-2025-37015

Senza: Keto & Fasting Android App version 2.10.15 package name com.gl.senza, developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful...

Improper Input Sanitization

github.com/mattermost/mattermost-server is vulnerable to improper input sanitization. The vulnerability is due to insufficient sanitization of user data during shared channel membership synchronization, which allows an attacker from a malicious or compromised remote cluster to access sensitive us...

CVE-2025-61114

The 2nd Line Android App (package name com.mysecondline.app) developed by AutoBizLine, Inc. is vulnerable to improper access control in its authentication mechanism in versions v1.2.92 and before . The root cause is that the server only validates the first character of the user_token, allowing at...

CVE-2025-61119

The Kanova Android App (version 1.0.27 , package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. An attacker can manipulate API request parameters to gain unauthorized access to sensitive user details and group information , which may include entr...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.2 that stems from the potential...

CVE-2025-61117: Improper Access Control

Senza: Keto & Fasting Android App version 2.10.15 package name com.gl.senza, developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful...

CVE-2025-61117

Senza: Keto & Fasting Android App version 2.10.15 package name com.gl.senza, developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful...

CVE-2025-61119

Kanova Android App version 1.0.27 package name com.karelane, developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful...