EUVD-2015-1455

Malware in sbrugna...

EUVD-2022-25554

Malicious code in bioql PyPI...

EUVD-2025-6072

Malicious code in bioql PyPI...

EUVD-2021-28731

Malicious code in bioql PyPI...

CVE-2025-40838 Ericsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability

Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests. Remediation Upgrade...

Comprehensive MCP Security Checklist: Protecting Your AI-Powered Infrastructure

With innovation comes risk. As organizations race to build AI-first infrastructure, security is struggling to keep pace. Multi-Agentic Systems – those built on Large Language Models LLMs and Multi-Component Protocols MCP - bring immense potential, but also novel vulnerabilities that traditional...

CVE-2025-6814

The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportnow function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal...

CVE-2023-0486

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS...

CVE-2023-0738

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...

CVE-2025-2786 Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...

CVE-2024-42176

HCL MyXalytics is affected by a concurrent login vulnerability affecting versions 6.3 through 6.4. The issue arises when simultaneous active sessions for a single credential may allow an attacker to access a user’s account or sensitive information. The PT-2025-11686 entry provides concrete affect...

CVE-2025-27646

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001...

CVE-2025-27646

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001...

CVE-2025-27646

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001...

CVE-2025-27646

CVE-2025-27646 affects Version: Vasion Print (formerly PrinterLogic) prior to Virtual Appliance Host 22.0.913 and Application 20.0.2253. Root cause described as an access-control issue that allows an Edit User Account Exposure, implying potential disclosure of user account information. CVSS v3.1 ...

CVE-2025-27646

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001...

CVE-2025-27646

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001...

PT-2023-21546 · Hewlett Packard · Hpe Oneview

Name of the Vulnerable Software and Affected Versions: HPE OneView affected versions not specified Description: The issue concerns the potential exposure of OneView user accounts through an HPE OneView appliance dump. Recommendations: At the moment, there is no information about a newer version...

CVE-2023-0486

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS...