EUVD-2022-53004

Malicious code in bioql PyPI...

EUVD-2023-33627

Malicious code in bioql PyPI...

EUVD-2022-52964

Malicious code in bioql PyPI...

EUVD-2025-5632

Malicious code in bioql PyPI...

EUVD-2023-58373

Malicious code in bioql PyPI...

EUVD-2023-29029

Malicious code in bioql PyPI...

EUVD-2025-26368

Malicious code in bioql PyPI...

EUVD-2022-42257

Malicious code in bioql PyPI...

EUVD-2022-43985

Malicious code in bioql PyPI...

EUVD-2024-51119

Malicious code in bioql PyPI...

EUVD-2022-52980

Malicious code in bioql PyPI...

EUVD-2024-45873

Malicious code in bioql PyPI...

EUVD-2025-25509

Malicious code in bioql PyPI...

EUVD-2022-53018

Malicious code in bioql PyPI...

EUVD-2022-53003

Malicious code in bioql PyPI...

EUVD-2022-52987

Malicious code in bioql PyPI...

EUVD-2022-53009

Malicious code in bioql PyPI...

EUVD-2022-53016

Malicious code in bioql PyPI...

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

...

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR e.g., .../downloadsbak,...