Vulnerabilidades

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.

A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can…

Vulnerability in the PeopleSoft Enterprise SCM Mobile Inventory Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Mobile…

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.

Corrupción de memoria al procesar múltiples llamadas IOCTL con la misma entrada de descriptor de archivo de búfer.

Corrupción de memoria al procesar múltiples llamadas IOCTL con la misma entrada de descriptor de archivo de búfer debido al acceso a memoria ya liberada.

Corrupción de memoria cuando se invocan operaciones de control de entrada/salida de dispositivo para mapear y desmapear búferes de memoria persistente debido a una sincronización inadecuada.

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

MVT (Mobile Verification Toolkit) ayuda a realizar análisis forenses de dispositivos móviles para encontrar signos de un posible compromiso. Antes de la versión 2026.5.12, existe una vulnerabilidad de salto de ruta a través de identificadores de archivo no saneados en el procesamiento de copias de seguridad de iOS.…

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both…

Vulnerabilidad de control de acceso inadecuado, autorización faltante en la aplicación móvil WriteUp de Kurt Software Studio permite acceder a funcionalidades no restringidas adecuadamente por las ACLs. Este problema afecta a la aplicación móvil WriteUp: desde la versión 1.3.0 hasta la 04062026.

Corrupción de memoria al usar Strongbox debido a desbordamiento de búfer.

Corrupción de memoria al usar Strongbox debido a la falta de verificación de límites.

Corrupción de memoria al procesar múltiples comandos IOCTL para operaciones de escape.