EUVD-2022-47525

Malicious code in bioql PyPI...

EUVD-2024-30370

Malicious code in bioql PyPI...

EUVD-2024-37392

Malicious code in bioql PyPI...

EUVD-2022-34575

Malicious code in bioql PyPI...

EUVD-2022-15986

Malicious code in bioql PyPI...

EUVD-2024-29047

Malicious code in bioql PyPI...

EUVD-2022-47533

Malicious code in bioql PyPI...

Malicious code in cj-tests-2fa (npm)

The package cj-tests-2fa was found to contain malicious code...

CVE-2025-53102

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

CVE-2025-53102

CVE-2025-53102 affects Discourse: prior to 3.4.7 (stable) and 3.5.0.beta.8 (tests-passed), issuing a physical security key for 2FA generates a WebAuthn challenge that is not cleared from the user session after authentication, potentially allowing reuse and increasing security risk. Affected versi...

CVE-2025-53545

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

CVE-2025-53545

The CVE-2025-53545 entry concerns Press, a Frappe custom app used with Frappe Cloud. The underlying issue is a lack of server-side validation that allows bypassing two-factor authentication (2FA) for users. The vulnerability description confirms that this is a 2FA bypass resulting from insufficie...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

CVE-2025-49592 n8n Login Flow has Open Redirect Vulnerability

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may...

PT-2025-27010

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.98.0 Description: The issue is an Open Redirect vulnerability in the login flow, affecting authenticated users who can be redirected to untrusted domains after logging in. This is achieved by crafting malicious URLs wi...

CVE-2025-49591 CryptPad 2FA Bypass Vulnerability

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication 2FA in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the...

About Cross Site Scripting – MDaemon Email Server (CVE-2024-11182)

About Cross Site Scripting - MDaemon Email Server CVE-2024-11182. An attacker can send an HTML-formatted email containing malicious JavaScript code embedded in an img tag. If the user opens the email in the MDaemon Email Server's web interface, the malicious JavaScript code will execute in the...

CVE-2024-48941

The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted...