{
"Source": "CVE FEED",
"Title": "CVE-2026-5453 - Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key",
"Content": "CVE ID :CVE-2026-5453
Published : April 3, 2026, 4:30 a.m. | 55 minutes ago
Description :A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/com/rico/mobile/di/SegmentSettingsModule.java of the component br.com.rico.mobile. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key
. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35537 - "Roundcube Webmail Deserialization File Write Vulnerability"",
"Content": "CVE ID :CVE-2026-35537
Published : April 3, 2026, 4:17 a.m. | 1 hour, 8 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5452 - UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key",
"Content": "CVE ID :CVE-2026-5452
Published : April 3, 2026, 4:17 a.m. | 1 hour, 8 minutes ago
Description :A flaw has been found in UCC CampusConnect App up to 14.3.5 on Android. This vulnerability affects unknown code of the file campusconnect/BuildConfig.java of the component campusconnect.ucc. This manipulation causes use of hard-coded cryptographic key
. The attack can only be executed locally. The exploit has been published and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35536 - Tornado Cookie Attribute Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35536
Published : April 3, 2026, 4:16 a.m. | 1 hour, 9 minutes ago
Description :In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35545 - Roundcube Webmail SVG Animate Element Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35545
Published : April 3, 2026, 4:02 a.m. | 1 hour, 23 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35544 - Roundcube Webmail CSS Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35544
Published : April 3, 2026, 3:59 a.m. | 1 hour, 26 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35543 - Roundcube Webmail SVG Image Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35543
Published : April 3, 2026, 3:57 a.m. | 1 hour, 28 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35542 - Roundcube Webmail Background Attribute Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35542
Published : April 3, 2026, 3:54 a.m. | 1 hour, 31 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35541 - Roundcube Webmail Password Comparison Type Confusion Vulnerability",
"Content": "CVE ID :CVE-2026-35541
Published : April 3, 2026, 3:50 a.m. | 1 hour, 35 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
Severity: 4.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35540 - Roundcube Webmail CSS Injection Vulnerability",
"Content": "CVE ID :CVE-2026-35540
Published : April 3, 2026, 3:47 a.m. | 1 hour, 38 minutes ago
Description :An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35539 - Roundcube Webmail Cross-Site Scripting Vulnerability",
"Content": "CVE ID :CVE-2026-35539
Published : April 3, 2026, 3:39 a.m. | 1 hour, 46 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-35538 - Roundcube Webmail IMAP Injection/CSRF Bypass",
"Content": "CVE ID :CVE-2026-35538
Published : April 3, 2026, 3:35 a.m. | 1 hour, 50 minutes ago
Description :An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
Severity: 3.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5458 - Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key",
"Content": "CVE ID :CVE-2026-5458
Published : April 3, 2026, 7 a.m. | 27 minutes ago
Description :A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/BuildConfig.java of the component com.afone.noelse. This manipulation of the argument SEGMENT_WRITE_KEY causes use of hard-coded cryptographic key
. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5457 - PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key",
"Content": "CVE ID :CVE-2026-5457
Published : April 3, 2026, 6:30 a.m. | 57 minutes ago
Description :A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key
. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5456 - Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key",
"Content": "CVE ID :CVE-2026-5456
Published : April 3, 2026, 6:15 a.m. | 1 hour, 12 minutes ago
Description :A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The manipulation of the argument CDAACCESS_TOKEN leads to use of hard-coded cryptographic key
. The attack must be carried out locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5455 - Dialogue App ca.diagram.dialogue config.json hard-coded key",
"Content": "CVE ID :CVE-2026-5455
Published : April 3, 2026, 6 a.m. | 1 hour, 27 minutes ago
Description :A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENT_WRITE_KEY can lead to use of hard-coded cryptographic key
. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-7024 - Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)",
"Content": "CVE ID :CVE-2025-7024
Published : April 3, 2026, 8:16 a.m. | 1 hour, 20 minutes ago
Description :Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse.


An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory.

This issue affects TETRA connectivity Server: 7.0.


Vulnerability fix is available and delivered to impacted customers.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-4350 - Perfmatters <= 2.5.9.1 - authenticated (subscriber+) arbitrary file deletion via 'delete' parameter",
"Content": "CVE ID :CVE-2026-4350
Published : April 3, 2026, 8:16 a.m. | 1 hour, 20 minutes ago
Description :The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-5462 - Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key",
"Content": "CVE ID :CVE-2026-5462
Published : April 3, 2026, 8:16 a.m. | 1 hour, 20 minutes ago
Description :A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfig.java of the component com.WahooFitness.SYSTM. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key
. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-28754 - Stored XSS Vulnerability",
"Content": "CVE ID :CVE-2026-28754
Published : April 3, 2026, 11:17 a.m. | 21 minutes ago
Description :Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2026-28756 - Stored XSS Vulnerability",
"Content": "CVE ID :CVE-2026-28756
Published : April 3, 2026, 11:17 a.m. | 21 minutes ago
Description :Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "03 Apr 2026",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹