Vulnerabilities

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.…

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock…

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to…

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application…

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026.

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know…