The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 have an insecure session management vulnerability. This flaw allows attackers to extract or intercept unencrypted session tokens (m_session_id) from application backups. These tokens remain valid for ten years, enabling attackers to read, modify, or delete the victim's account authentication data, potentially locking out the legitimate user.
The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 have a vulnerability related to cleartext network traffic. This flaw allows attackers on untrusted networks to intercept or modify unencrypted HTTP communications between the app and its server. Specifically, the absence of an Android network security configuration enables manipulation of support content displayed to users by tampering with the HTTP traffic.
The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 contain a hardcoded credentials vulnerability. Attackers can extract confidential third-party integration secrets by decompiling the APK, including credentials for WeChat, Tencent QQ, and Fitbit. This allows potential abuse of active third-party application registrations.
A vulnerability in 6amTech 6valley 16.0 affects the Social Login Flow component, specifically the existingAccountCheck function. Manipulation of the user_response argument can lead to authorization bypass. The vulnerability can be exploited remotely and public exploit code is available. The CVSS score is 7.3, indicating high severity.
A vulnerability in NPC-Worldwide npcpy up to version 2.1.27 affects the get_mlx_response function in the MLX Provider component. The flaw involves improper input validation of the 'model' argument, which can be exploited remotely. Public exploit code is available. The CVSS score is 6.3, indicating a medium severity impact.
A vulnerability exists in yangzongzhuan RuoYi-Vue up to version 3.9.2 affecting the SysPermissionService.getMenuPermission function. This flaw involves improper privilege management due to manipulation of the perms argument, allowing a remote attacker to potentially escalate privileges. The vendor has not responded to disclosure attempts. The CVSS score is 6.3, indicating a medium severity level.
A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.
Multiple security vulnerabilities affecting the Linux kernel have been addressed in a security update. Among these is CVE-2026-64541, a use-after-free (UAF) flaw in the net/smc component fixed by pinning the socket in smc_cdc_rx_handler(). The update also fixes several other kernel vulnerabilities across various subsystems including SCTP, s390 architecture, sunrpc, and openvswitch. These issues could potentially impact system stability and security. Red Hat Enterprise Linux 9 users with kernel versions prior to 5.14.0-687.66.1.el9_8 are affected. A security update is available and should be applied with a system reboot.
NewsBreak for Android version 26.21.0 has a vulnerability where data:text/html; URLs are incorrectly trusted in its WebView JavaScript bridge origin check. This flaw allows an attacker to craft a newsbreak://openweb deep link that, when opened by a user, can invoke the getLoginInfo action via NBJS.callNative. This results in disclosure of the signed-in user's account information and session token.
Chewy for Android version 26.23.0 has a vulnerability where it does not properly validate the host of product-details deep links before loading them in a Hybrid WebView. This allows an attacker to craft a malicious link with a specific path that can access a JavaScript interface and retrieve signed-in users' pet profile information.
A vulnerability in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component.
ReelShort for Android version 3.8.55 contains a vulnerability where it loads an attacker-controlled activityUrl via a cmsvictor://open deep link in a WebView. This WebView exposes Android and Offerwall JavaScript bridges without validating the page origin, allowing a crafted page to invoke methods that retrieve user metadata and encrypted credential payloads.
A heap out-of-bounds read/write vulnerability exists in the PSD thumbnail loader component of GIMP (GNU Image Manipulation Program), identified as CVE-2026-112257. This flaw affects multiple versions of GIMP prior to the fixed releases. The vulnerability could lead to memory corruption during processing of PSD thumbnails. An update addressing this issue is available and has been released by Red Hat for affected versions.
The npm package @secauditb20y/sec-test-b1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '@secaudita10x/sec-test-a1' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the severity of the compromise, complete remediation may require rotating all secrets and keys from a different, uncompromised machine.
The dogmans-afterglow npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The npm package 'thththtbhthhth' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'nannnnnnnnn' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.
The npm package 'heheheshsds' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.