Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

145 results · page 2 of 3

Apr 15, 2025Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-3698 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Mar 11, 2025The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.CVE-2025-2190 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 8.1
The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
Product
com.transsnet.store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Feb 14, 2025Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.CVE-2025-1298 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Feb 13, 2025With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected dCVE-2025-24836 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.1
With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 13, 2025An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enablCVE-2025-23421 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 13, 2025The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file.CVE-2025-20615 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.2
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24805 · Other software · MobSF · reported by GitHubHigh 8.5
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24804 · Other software · MobSF · reported by GitHubMedium 4.8
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. When the application parses the wrong characters in the bundle ID, it encounters an error. As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.apple.com github.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24803 · Other software · MobSF · reported by GitHubHigh 8.4
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.apple.com github.com
Jan 20, 2025Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-0590 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPMobile.App — Android and iOS Mobile Application
Affected
up to 11.52
What to do
Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.CVE-2024-12603 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
Product
com.transsion.applock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Nov 17, 2024Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions CVE-2024-52876 · Other software · holy_stone_remote_id_module · reported by MITREHigh 7.5
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
Product
holy_stone_remote_id_module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coalfire.com
Nov 14, 2024Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.CVE-2024-11206 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.
Product
com.transsion.phoenix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Oct 15, 2024Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.CVE-2024-10018 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.
Product
com.transsion.aivoiceassistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Sep 14, 2024Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks.CVE-2024-8039 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks.
Product
com.afmobi.boomplayer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Aug 26, 2024Tophat is a mobile applications testing harness.CVE-2024-45036 · Other software · Shopify · reported by GitHubMedium 4.3
Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send this token to the attacker's server without any checks to ensure that the server is trusted. This token can then be used to access internal build artifacts, for mobile applications, not intended to be public. The issue has been patched as of version 1.10.0. The ability to request artifacts using a Tophat API has been deprecated as this flow was inherently insecure. Systems that have implemented this kind of endpoint should cease use and invalidate the token immediately. There are no workarounds and all users should update as soon as possible.
Product
tophat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 12, 2024Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.CVE-2024-7697 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jul 31, 2024Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.CVE-2024-41955 · Other software · MobSF · reported by GitHubMedium 5.2
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 15, 2024Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.CVE-2024-6780 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaLow 3.3
Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
Product
com.android.server.telecom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jun 28, 2024HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.CVE-2024-30135 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.
Product
DRYiCE AEX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application.CVE-2024-30111 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
Product
DRYiCE AEX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 16, 2024Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.CVE-2024-5163 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jun 12, 2024HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via moCVE-2024-2300 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6.2
HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices.
Product
HP Advance Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
May 21, 2024The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.CVE-2024-4988 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.
Product
com.transsion.videocallenhancer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
May 14, 2024Microsoft Intune for Android Mobile Application Management Tampering VulnerabilityCVE-2024-30059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
Product
Microsoft Intune Mobile Application Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Apr 4, 2024Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.CVE-2024-31215 · Other software · MobSF · reported by GitHubMedium 6.3
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 3, 2024Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) CVE-2023-5879 · Other software · The Genie Company · reported by cve@rapid7.comMedium 6.8
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.
Product
Aladdin Connect Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com rapid7.com
Nov 7, 2023An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app.CVE-2021-43419 · Other software · opayweb · reported by MITREHigh 7.5
An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app.
Product
opay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com youtube.com
Oct 9, 2023HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.CVE-2023-5365 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.
Product
HP LIFE Android Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jun 5, 2023Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsTCVE-2023-3066 · Other software · Mobatime · reported by vulnerability@ncsc.chHigh 8.1
Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.
Product
Mobatime mobile application AMXGT100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io
Jun 5, 2023Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT1CVE-2023-3065 · Other software · Mobatime · reported by vulnerability@ncsc.chCritical 9.1
Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.
Product
Mobatime mobile application AMXGT100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io
Jun 5, 2023Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects MobCVE-2023-3064 · Other software · Mobatime · reported by vulnerability@ncsc.chHigh 7.5
Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.
Product
Mobatime mobile application AMXGT100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request.CVE-2022-38771 · Other software · Transtek · reported by MITRECritical 9.8
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request.
Product
Mojodat Fixed Asset Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mojodat-vulnerabilities.netlify.app transtek.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login requestCVE-2022-38770 · Other software · Transtek · reported by MITREMedium 5.3
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login request.
Product
Mojodat Fixed Asset Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mojodat-vulnerabilities.netlify.app transtek.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login requeCVE-2022-38769 · Other software · Transtek · reported by MITREHigh 7.5
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request.
Product
Mojodat Fixed Asset Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mojodat-vulnerabilities.netlify.app transtek.com
Sep 13, 2022The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization.CVE-2022-38768 · Other software · Transtek · reported by MITRECritical 9.8
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization.
Product
Mojodat Fixed Asset Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mojodat-vulnerabilities.netlify.app transtek.com
Aug 18, 2022Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable informatCVE-2022-29507 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access.
Product
Team Blue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Jul 27, 2022Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges CVE-2022-35291 · Network & remote access · SAP SuccessFactors · reported by cna@sap.comHigh 8.1
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application
Product
SAP SuccessFactors Mobile Application for Android & iOS devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Apr 30, 2022A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID WCVE-2021-41994 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 6.6
A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
Product
PingID Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pingidentity.com pingidentity.com
Apr 30, 2022A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingCVE-2021-41993 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 6.6
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
Product
PingID Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pingidentity.com pingidentity.com
Dec 14, 2021Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup.CVE-2021-43388 · Other software · Unisys · reported by MITREHigh 7.5
Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
Product
Cargo Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record public.support.unisys.com public.support.unisys.com
Nov 4, 2021Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to accesCVE-2021-25507 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.7
Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to access part of notification data in Secure Folder without authorization.
Product
Samsung Flow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Oct 25, 2021Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote aCVE-2021-40527 · Other software · Onepeloton · reported by MITREHigh 8.6
Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application.
Product
Peloton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twitter.com twitter.com
Oct 12, 2021A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimCVE-2021-40498 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks.
Product
SAP SuccessFactors Mobile Application (for Android devices)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Aug 2, 2021The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (againsCVE-2021-27943 · Other software · Vizio · reported by MITREHigh 7.5
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (against only 10000 possibilities), allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and configurations.
Product
P65-f1 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record l9group.com vizio.com
Aug 2, 2021Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applicatCVE-2021-27503 · Other software · Ypsomed · reported by ics-cert@hq.dhs.govMedium 4.8
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application encrypts on the application layer of the communication protocol between the Ypsomed mylife App and mylife Cloud credentials based on hard-coded secrets, which allows man-in-the-middle attackers to tamper with messages.
Product
Mylife
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Aug 2, 2021Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applicatCVE-2021-27499 · Other software · Ypsomed · reported by ics-cert@hq.dhs.govMedium 5.9
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-the-middle attackers to tamper with messages.
Product
Mylife
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 30, 2021Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylifCVE-2021-27495 · Other software · Ypsomed · reported by ics-cert@hq.dhs.govHigh 7.1
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint.
Product
Mylife
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 30, 2021Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed myliCVE-2021-27491 · Other software · Ypsomed · reported by ics-cert@hq.dhs.govHigh 7.5
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process.
Product
Mylife
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.