EUVD-2023-27466

Malicious code in bioql PyPI...

EUVD-2022-36939

Malicious code in bioql PyPI...

EUVD-2024-35878

Malicious code in bioql PyPI...

EUVD-2024-34438

Malicious code in bioql PyPI...

EUVD-2024-46667

Malicious code in bioql PyPI...

EUVD-2022-15429

Malicious code in bioql PyPI...

CVE-2025-41094

The CVE-2025-41094 issue affects Bold Workplanner. An Insecure Direct Object Reference (IDOR) exists in versions prior to 2.5.25 (4935b438f9b) due to insufficient input validation, enabling an authenticated user to access functional contract details via unauthorized internal identifiers. Multiple...

CVE-2025-36146 IBM watsonx.data information disclosure

IBM Lakehouse watsonx.data 2.2 could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system...

Linux Distros Unpatched Vulnerability : CVE-2024-27930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated us...

CVE-2025-58158 Harness Affected by Arbitrary File Write in Gitness LFS server

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server Gitness exposes api to retrieve and upload files via git LFS. Implementation ...

CVE-2025-43768

Summary: CVE-2025-43768 affects Liferay Portal and Liferay DXP. Vulnerable software includes Liferay Portal 7.4.0–7.4.3.131 and Liferay DXP releases up to 2024.Q4.7 (and related 2024.Q3.13, Q2.13, Q1.15, plus 7.4 GA up to update 92). Root cause: JSONWS APIs can be accessed by authenticated users ...

Linux Distros Unpatched Vulnerability : CVE-2021-32029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of...

CVE-2025-3671

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2017-15093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and...

CVE-2025-6256 Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-31796 · Unknown · Openplc Runtime

Name of the Vulnerable Software and Affected Versions: OpenPLC Runtime versions 3 through 9cd8f1b Description: An authenticated user can upload arbitrary files, such as .html or .svg, through the /edit-user endpoint in the webserver. These uploaded files are then publicly accessible under the...

CVE-2025-4684 BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image...

CVE-2025-36040

IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...

CVE-2025-50849

CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference IDOR. The user profile functionality allows enabling or disabling stickers through a parameter companyid sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate...

CVE-2025-46732 OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation mutations of OpenCTI allows an authenticated...