EUVD-2025-9378

Malicious code in bioql PyPI...

EUVD-2022-54566

Malicious code in bioql PyPI...

EUVD-2023-26629

Malicious code in bioql PyPI...

EUVD-2024-50035

Malicious code in bioql PyPI...

EUVD-2022-15393

Malicious code in bioql PyPI...

EUVD-2025-16931

Malicious code in bioql PyPI...

EUVD-2025-16907

Malicious code in bioql PyPI...

EUVD-2024-37554

Malicious code in bioql PyPI...

EUVD-2025-3892

Malicious code in bioql PyPI...

EUVD-2023-2071

Malicious code in bioql PyPI...

MAL-2025-41464 Malicious code in @twork-data-services/aggregator-sme-task-info (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41462 Malicious code in @twork-data-services/aggregator-sme-group-queues (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41461 Malicious code in @twork-data-services/aggregator-sme-company-signers-role-filter (npm)

--- -= Per source details. Do not edit below this line.=-...

Linux Distros Unpatched Vulnerability : CVE-2025-21943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both newdevicestore and...

AdRo-FL: Informed and Secure Client Selection for Federated Learning in the Presence of Adversarial Aggregator

Whitepaper called AdRo-FL: Informed And Secure Client Selection For Federated Learning In The Presence Of Adversarial Aggregator...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: gpio: aggregator: Protect driver attr handlers against module unload Both newdevicestore and deletedevicestore interact with module global resources e.g., gpioaggregatorlock. To prevent race conditions during module unloading,...

CVE-2025-31136

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting XSS issue that occurs in f.php when SVG favicons are downloaded from an attacker-controlled feed containing...

CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-31136

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting XSS issue that occurs in f.php when SVG favicons are downloaded from an attacker-controlled feed containing tags...

CVE-2025-46339

FreshRSS prior to version 1.26.2 is vulnerable to favicon cache poisoning via a manipulated feed URL and an attacker-controlled proxy with SSL verification disabled. The underlying issue is the favicon hash computation, which hashes the feed URL and a salt but omits proxy address, proxy protocol,...