Archive
4 September 2025
Vulnerabilities first published on this day (UTC), newest first.
113 results · Clear filters · Feed
-
High 7.5
Hono contains a flaw in URL path parsing, potentially leading to path confusion
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location bl…
-
High 7.2
Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…
-
High 7.5
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
-
High 7.8
In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabli…
-
High 8.2
Promptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses mu…
-
High 7.8
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to …
-
High 7.8
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility s…
-
High 7.8
In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permis…
-
High 8.4
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in th…
-
High 7.8
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default v…
-
High 7.8
In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app…
-
High 7.3
In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper…
-
High 7.8
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic e…
-
High 7.8
In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to …
-
High 7.8
In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. …
-
High 7.3
In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the priv…
-
High 7.3
In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead…
-
High 7.8
In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in…
-
High 7.1
In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a con…
-
High 7.8
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could l…
-
High 8.8
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use af…
KEV Sep 4, 2025 -
High 7.8
In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improp…
-
High 7.8
In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the c…
-
High 8.0
In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead …
-
High 7.1
In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This co…
-
High 7.8
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismat…
-
High 8.8
In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic er…
-
High 7.3
In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission d…
-
High 7.8
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. …
-
High 7.8
In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic er…
-
High 7.8
In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a log…
-
High 7.8
In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due t…
-
High 7.8
In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to …
-
High 7.8
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an un…
-
High 7.8
In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a co…
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
High 7.8
In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in t…
-
High 7.8
In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalati…
-
High 7.8
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error …
-
High 7.8
In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This c…