Archive
4 September 2025
Vulnerabilities first published on this day (UTC), newest first.
272 results · Feed
-
High 7.5
Hono contains a flaw in URL path parsing, potentially leading to path confusion
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location bl…
-
Medium 6.0
frost-core: refresh shares with smaller min_signers will reduce group security
ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold…
-
High 7.2
Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…
-
Low 2.1
Weblate has long session expiry times during second factor verification
Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This is…
-
Medium 5.1
api: Shared OAuth Signing Key Between Different Instances
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed…
-
Critical 10.0
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability
-
High 7.5
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
-
Medium 6.5
Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network.
-
Critical 10.0CVE-2025-54914 Public exploit
Azure Networking Elevation of Privilege Vulnerability
Azure Networking Elevation of Privilege Vulnerability
-
Critical 9.0
Azure Bot Service Elevation of Privilege Vulnerability
Azure Bot Service Elevation of Privilege Vulnerability
-
Medium 6.1
Electron is vulnerable to Code Injection via resource modification
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via …
-
Medium 5.1
FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel
contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX all…
-
Critical 10.0CVE-2025-55190 Scanner template
Argo CD: Project API Token Exposes Repository Credentials
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive rep…
-
Critical 9.3
Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, b…
-
High 7.8
In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabli…
-
High 8.2
Promptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses mu…
-
High 7.8
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to …
-
High 7.8
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility s…
-
Low 3.3
In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. Thi…
-
Medium 6.2
In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility …
-
Medium 4.0
In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local…
-
High 7.8
In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permis…
-
Medium 4.0
In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new…
-
Critical 9.4
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
### Summary A Use-After-Free (UAF) vulnerability has been discovered in the Sdf_PathNode module of the Pixar OpenUSD library. This issue occurs during the deletion of the Sdf_PrimPathNode object in multi-threaded environments, where freed memory is accessed. …
-
High 8.4
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in th…
-
High 7.8
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default v…
-
Medium 5.0
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This coul…
-
Medium 5.5CVE-2025-48561 Public exploit
In multiple locations, there is a possible way to access data displayed on the screen due to side channel information d…
-
Medium 5.5
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This coul…
-
Medium 5.5
In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input va…
-
High 7.8
In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app…
-
High 7.3
In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper…
-
Medium 6.1
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a …
-
High 7.8
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic e…
-
High 7.8
In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to …
-
Medium 5.0
In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confuse…
-
Medium 5.5
In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path tra…
-
High 7.8
In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. …
-
High 7.3
In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the priv…
-
High 7.3
In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead…