EUVD-2022-46980

Malicious code in bioql PyPI...

EUVD-2024-42577

Malicious code in bioql PyPI...

EUVD-2023-1579

Malicious code in bioql PyPI...

EUVD-2024-49116

Malicious code in bioql PyPI...

EUVD-2023-50475

Malicious code in bioql PyPI...

EUVD-2024-20709

Malicious code in bioql PyPI...

CVE-2025-53595

CVE-2025-53595 concerns QNAP Qsync Central. Multiple connected sources confirm an SQL injection vulnerability in Qsync Central caused by inadequate validation of externally supplied SQL statements, allowing a remote user with an account to potentially execute unauthorized code or commands. A fixe...

CVE-2024-55017

Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirecturi parameter allows attackers to intercept authorization codes and gain unauthorized access to victim accounts...

Corezoid Process Engine 安全漏洞

Corezoid Process Engine is an application from Corezoid, Inc. helps companies build, manage, host and run processes in the cloud. A security vulnerability exists in Corezoid Process Engine version 6.6.0, which stems from the presence of an open redirection in the redirecturi parameter in the OAut...

CVE-2025-59335

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized use...

ROS-20250912-16

Apache Tomcat application server vulnerability is related to access differentiation flaws. Exploitation vulnerability could allow an attacker acting remotely to hijack a session and gain access to a user's user account...

ROS-20250912-15

Apache Tomcat application server vulnerability is related to access differentiation flaws. Exploitation vulnerability could allow an attacker acting remotely to hijack a session and gain access to a user's user account...

SingleStore: 2FA bypass possible on https://authsvc.singlestore.com

A vulnerability was discovered that allowed the 2FA authentication mechanism to be bypassed completely. An attacker could access the victim's account by only knowing the email address and password, without requiring the 2FA code...

CVE-2025-29878 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

PT-2025-36007

Name of the Vulnerable Software and Affected Versions pgAdmin versions prior to 9.7 Description pgAdmin is susceptible to a Cross-Origin Opener Policy COOP issue. This allows manipulation of the OAuth flow, potentially resulting in unauthorized account access, account takeover, data breaches, and...

CVE-2025-50503

The CVE-2025-50503 entry concerns Touch Lebanon Mobile App 2.20.2, where a flaw in the password reset workflow enables bypassing the OTP mechanism, potentially allowing an unauthorized user to reset a password and access an account without a legitimate authentication factor. The incident is descr...

PT-2025-34054 · Unknown · Touch Lebanon Mobile App

Name of the Vulnerable Software and Affected Versions: Touch Lebanon Mobile App version 2.20.2 Description: A flaw exists in the password reset workflow that allows an attacker to bypass the one-time password OTP reset password mechanism. By manipulating the reset process, an unauthorized user ma...

The vulnerability of the Apache Tomcat application server, related to deficiencies in access control, allows attackers to intercept sessions and gain access to user accounts.

The vulnerability of the Apache Tomcat application server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to intercept sessions and gain access to the user account...

Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)

Summary NATS-Server is used by Astronomer with IBM as part of the messaging functionality. Vulnerability Details CVEID:CVE-2025-30215 DESCRIPTION: NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27...

Online portal exposed car and personal data, allowed anyone to remotely unlock cars

A carmaker’s online dealership portal has been found leaking the private information and vehicle data of its customers. This also meant that anyone with access could remotely break into a car. Researcher Eaton Zveare shared his discovery with TechCrunch. Although he said he has chosen not to...