Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

276 results · page 3 of 6

May 5, 2025Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.CVE-2025-46335 · Other software · MobSF · reported by GitHubHigh 8.6
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 17, 2025Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through <= 0.4.61.
Product
Mobile App for WooCommerce
Affected
up to 0.4.61
What to do
Affects up to 0.4.61. Update Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-3698 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Apr 14, 2025Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g.CVE-2025-30516 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2
Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Apr 1, 2025Mobile App Canvas: Missing AuthorizationCVE-2025-31816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pietro Mobile App Canvas mobile-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile App Canvas: from n/a through <= 3.8.2.
Product
Mobile App Canvas
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Mobile App Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application CVE-2025-1558 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Mar 16, 2025A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android.CVE-2025-2342 · Other software · IROAD · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpoint. The manipulation leads to hard-coded credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
X5 Mobile App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 13, 2025AppPresser – Mobile App Framework: Stored Cross-Site ScriptingCVE-2025-1561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.10
What to do
Affects up to 4.4.10. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.CVE-2025-2190 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 8.1
The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
Product
com.transsnet.store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Feb 14, 2025Exposed Dangerous Method or Function vulnerability in PTT Inc.CVE-2024-12651 · Other software · PTT Inc. · reported by iletisim@usom.gov.trHigh 8.5
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0.
Product
HGS Mobile App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Feb 14, 2025Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.CVE-2025-1298 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Feb 13, 2025With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected dCVE-2025-24836 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.1
With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 13, 2025An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enablCVE-2025-23421 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 13, 2025The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file.CVE-2025-20615 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.2
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
Product
Heart Health IOS Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov qardio.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24805 · Other software · MobSF · reported by GitHubHigh 8.5
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24804 · Other software · MobSF · reported by GitHubMedium 4.8
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. When the application parses the wrong characters in the bundle ID, it encounters an error. As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.apple.com github.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24803 · Other software · MobSF · reported by GitHubHigh 8.4
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.apple.com github.com
Jan 23, 2025ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates.CVE-2024-52329 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.5
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
Product
ECOVACS HOME
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dontvacuum.me dontvacuum.me
Jan 20, 2025Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-0590 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jan 15, 2025Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any usCVE-2025-0476 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Jan 15, 2025Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.CVE-2025-21083 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Jan 15, 2025Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.CVE-2025-20036 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Dec 16, 2024Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file pCVE-2024-11358 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.7
Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file provider.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPMobile.App — Android and iOS Mobile Application
Affected
up to 11.52
What to do
Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.CVE-2024-12603 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
Product
com.transsion.applock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Dec 5, 2024This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database.CVE-2024-12094 · Other software · Mogify Infotech · reported by vdisclose@cert-in.org.inMedium 5.4
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.
Product
Tinxy Android app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Nov 26, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-11024 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2024Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions CVE-2024-52876 · Other software · holy_stone_remote_id_module · reported by MITREHigh 7.5
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
Product
holy_stone_remote_id_module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coalfire.com
Nov 14, 2024Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.CVE-2024-11206 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.
Product
com.transsion.phoenix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Nov 4, 2024Stacks Mobile App Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024Stacks Mobile App Builder: Unrestricted Upload of File with Dangerous TypeCVE-2024-50527 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Stacks Mobile App Builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App: Stored Cross-Site ScriptingCVE-2024-9873 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App
Affected
up to 6.4.6.1
What to do
Affects up to 6.4.6.1. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2024Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.CVE-2024-10018 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.
Product
com.transsion.aivoiceassistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Oct 15, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-9305 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.4
What to do
Affects up to 4.4.4. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtaCVE-2024-43201 · Other software · Planet Fitness · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).
Product
Planet Fitness Workouts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record apps.apple.com dontvacuum.me
Sep 16, 2024Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the CVE-2024-45833 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.5
Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Sep 14, 2024Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks.CVE-2024-8039 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks.
Product
com.afmobi.boomplayer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Aug 26, 2024Tophat is a mobile applications testing harness.CVE-2024-45036 · Other software · Shopify · reported by GitHubMedium 4.3
Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send this token to the attacker's server without any checks to ensure that the server is trusted. This token can then be used to access internal build artifacts, for mobile applications, not intended to be public. The issue has been patched as of version 1.10.0. The ability to request artifacts using a Tophat API has been deprecated as this flow was inherently insecure. Systems that have implemented this kind of endpoint should cease use and invalidate the token immediately. There are no workarounds and all users should update as soon as possible.
Product
tophat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 12, 2024Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.CVE-2024-7697 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jul 31, 2024Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.CVE-2024-41955 · Other software · MobSF · reported by GitHubMedium 5.2
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Product
Mobile-Security-Framework-MobSF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 20, 2024Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Appmaker Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps allows Reflected XSS.This issue affects Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps: from n/a through 1.36.12.
Product
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps
Affected
up to 1.36.12
What to do
Affects up to 1.36.12. Update Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 15, 2024Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.CVE-2024-6780 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaLow 3.3
Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
Product
com.android.server.telecom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jul 15, 2024Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a maCVE-2024-39767 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.2
Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jul 15, 2024Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LCVE-2024-32945 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.6
Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 28, 2024HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.CVE-2024-30135 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.
Product
DRYiCE AEX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application.CVE-2024-30111 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
Product
DRYiCE AEX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 16, 2024Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.CVE-2024-5163 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jun 12, 2024HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via moCVE-2024-2300 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6.2
HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices.
Product
HP Advance Mobile Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
May 21, 2024The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.CVE-2024-4988 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.
Product
com.transsion.videocallenhancer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.