EUVD-2022-41815

Malicious code in bioql PyPI...

EUVD-2022-52781

Malicious code in bioql PyPI...

EUVD-2025-23930

Malicious code in bioql PyPI...

EUVD-2022-24682

Malicious code in bioql PyPI...

EUVD-2024-34087

Malicious code in bioql PyPI...

EUVD-2023-1943

Malicious code in bioql PyPI...

EUVD-2025-6274

Malicious code in bioql PyPI...

EUVD-2022-38170

Malicious code in bioql PyPI...

EUVD-2023-32661

Malicious code in bioql PyPI...

CVE-2025-54124 XWiki Platform: Any user with editing rights can access password properties through Database List Properties

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

CVE-2025-54573 CVAT vulnerable to email verification bypass by use of basic authentication

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified...

PT-2025-31138 · WordPress · No Boss Testimonials

Name of the Vulnerable Software and Affected Versions: No Boss Testimonials versions 1.0.0 through 3.0.0 No Boss Testimonials versions 4.0.0 through 4.0.2 Description: A stored Cross-Site Scripting XSS issue exists in the No Boss Testimonials component. This allows an attacker to inject malicious...

GHSA-56R6-CCM5-8HG3 Alchemy Non-SMA and Webauthn Account Security Advisory

Impact A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted. Patches Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or...

Alchemy Non-SMA and Webauthn Account Security Advisory

Impact A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted. Patches Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or...

DRUPAL-CONTRIB-2025-088

This module enables users to login by email address with the minimal configurations. The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an...

CVE-2025-53374 Dokploy Improperly Discloses User Information via user.one Endpoint

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...

The vulnerability of the Blitz Identity Provider software, related to deficiencies in the authentication process, allows a perpetrator to change the email address of a user’s account.

The vulnerability of the Blitz Identity Provider software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to change the email address of a user’s account remotely...

PT-2025-27497 · Graylog · Graylog

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 6.2.4 Graylog versions prior to 6.3.0-rc.2 Description: A flaw in Graylog allows authenticated users to escalate privileges via API token abuse. This issue can be exploited by creating and using API tokens for the...

CVE-2025-47849 Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account

Phone numbers are a gold mine for SIM swappers. A researcher found how to get this precious piece of information through a clever brute-force attack...