EUVD-2022-40385

Malicious code in bioql PyPI...

EUVD-2024-47245

Malicious code in bioql PyPI...

EUVD-2022-28575

Malicious code in bioql PyPI...

EUVD-2024-0025

Malicious code in bioql PyPI...

EUVD-2025-6872

Malicious code in bioql PyPI...

EUVD-2022-41840

Malicious code in bioql PyPI...

EUVD-2024-31993

Malicious code in bioql PyPI...

EUVD-2025-6924

Malicious code in bioql PyPI...

EUVD-2024-0023

Malicious code in bioql PyPI...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

GHSA-W64R-2G3W-W8W4 Coder AgentAPI exposed user chat history via a DNS rebinding attack

Summary AgentAPI prior to version 0.4.0 was susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. Impact An attacker could have gained access to the /messages endpoint served by the Agent API. This allowed for the unauthorized exfiltration of sensitive user...

Coder AgentAPI exposed user chat history via a DNS rebinding attack

Summary AgentAPI prior to version 0.4.0 was susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. Impact An attacker could have gained access to the /messages endpoint served by the Agent API. This allowed for the unauthorized exfiltration of sensitive user...

rhel-lightspeed: Improper Access Control in Lightspeed History Management Allows Local Privilege Manipulation

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

rhel-lightspeed: Improper Access Control in Lightspeed History Management Allows Local Privilege Manipulation

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

CVE-2025-5962 Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

CVE-2025-5962

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

Red Hat OpenShift Lightspeed 安全漏洞

Red Hat OpenShift Lightspeed is an acceleration tool based on the OpenShift platform from Red Hat, Inc. It is designed to increase the speed of development and deployment of Kubernetes applications. A security vulnerability exists in Red Hat OpenShift Lightspeed, which stems from insufficient...

Detecting Data Leaks Before Disaster

In January 2025, cybersecurity experts at Wiz Research found that Chinese AI specialist DeepSeek had suffered a data leak, putting more than 1 million sensitive log streams at risk. According to the Wiz Research team, they identified a publicly accessible ClickHouse database belonging to DeepSeek...

ChatPlayground.ai Cross Site Scripting / Insecure Direct Object Reference

ChatPlayground.ai is a popular web application for comparing AI models. A cross site scripting vulnerability exists in the chat component. This can lead to JWT token theft and remote account hijacking. Additionally, the /api/chat-history endpoint exhibits weak access control allowing for insecure...