1885 matches found
EUVD-2023-33082
Malicious code in bioql PyPI...
EUVD-2025-13413
Malicious code in bioql PyPI...
EUVD-2024-0061
Malicious code in bioql PyPI...
EUVD-2024-1007
Malicious code in bioql PyPI...
EUVD-2024-2353
Malicious code in bioql PyPI...
QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.
...
bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
...
Domino Effect: How One Vendor's AI App Breach Toppled Giants
A single AI chatbot breach at Salesloft-Drift exposed data from 700+ companies, including security leaders. The attack shows how AI integrations expand risk, and why controls like IP allow-listing, token security, and monitoring are critical...
CVE-2025-39886 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allowspinning=false path in bpftimerinit Currently, calling bpfmapkmallocnode from bpfasyncinit can cause various locking issues; see the following stack trace edited for style as one example: ... 10.011566...
CVE-2025-46408
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.PushHttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOWALLHOSTNAMEVERIFIER, bypassing domain validation...
EulerOS 2.0 SP10 : udisks2 (EulerOS-SA-2025-2117)
According to the versions of the udisks2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
EulerOS 2.0 SP12 : libblockdev (EulerOS-SA-2025-2014)
According to the versions of the libblockdev packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
EulerOS 2.0 SP10 : libblockdev (EulerOS-SA-2025-2102)
According to the versions of the libblockdev packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the 'allowactive' setting in Polkit permits a physically...
Google Android Denial of Service Vulnerability (CNVD-2025-24502)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability caused by resource exhaustion when repeatedly adding allowed packages to the allowPackageAccess function in multiple files. An attacker could exploit the...
CVE-2025-26463
In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-26463
In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-26463
A denial of service vulnerability exists in Google Android due to uncontrolled resource consumption. Specifically, the allowPackageAccess function in multiple files can be triggered to exhaust resources when an attacker repeatedly adds allowed packages. This vulnerability allows for a local persi...
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
...
PT-2025-36027
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: Resource exhaustion is possible in the allowPackageAccess function across multiple files when repeatedly adding allowed packages. This can result in a local...
CVE-2025-9260
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated...