PSF-2026-9

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

CVE-2026-2297 SourcelessFileLoader does not use io.open_code()

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

CVE-2026-2297

CVE-2026-2297 concerns CPython’s import system: the SourcelessFileLoader (legacy .pyc handling) is misimplemented in FileLoader, causing it not to use io.open_code() to read .pyc files. As a result, sys.audit events for this audit point do not fire. The description notes an audit-impacting behavi...

PT-2026-23068

Name of the Vulnerable Software and Affected Versions CPython affected versions not specified Description The import hook in CPython that handles legacy .pyc files using SourcelessFileLoader is incorrectly handled within FileLoader, a base class. This results in the failure to utilize io.open cod...

CVE-2026-3494

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERYDML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen — or hash style comments, the statement is...

CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERYDML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen — or hash style comments, the statement is...

CVE-2019-12847

In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period...

Authorization Bypass

Liferay Portal and Liferay DXP are vulnerable to Authorization Bypass. The vulnerability is due to improper access control on the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter, which allows an authenticated attacker in one virtual instance to view audit events belongin...

EUVD-2021-21866

Malware in sbrugna...

EUVD-2015-2186

Malware in sbrugna...

EUVD-2025-30441

Malicious code in bioql PyPI...

EUVD-2025-31770

Malicious code in bioql PyPI...

EUVD-2025-27294

Malicious code in bioql PyPI...

EUVD-2022-42790

Malicious code in bioql PyPI...

CVE-2025-43827

Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter. An attacker can access audit events belonging to a different virtual instance by specifying the identifi...

GHSA-PW86-QVX9-34R7 Liferay Portal Vulnerable to IDOR via audit events

Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...

Liferay Portal Vulnerable to IDOR via audit events

Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter. An attacker can access audit events belonging to a different virtual instance by specifying the identifi...

CVE-2025-43827

Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...