EUVD-2009-0257

Malware in sbrugna...

EUVD-2023-32485

Malicious code in bioql PyPI...

EUVD-2025-30835

Malicious code in bioql PyPI...

EUVD-2025-30260

Malicious code in bioql PyPI...

PT-2025-40345

Name of the Vulnerable Software and Affected Versions Hiberus Sintra affected versions not specified Description An incorrect Cross-Origin Resource Sharing CORS configuration exists in Hiberus Sintra. CORS allows browsers to make cross-domain requests in a controlled manner, using the “Origin”...

CVE-2025-11155 WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials...

MAL-2025-47397 Malicious code in capacitor-plugin-vonage (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d89f3813eea824f42ffe8eba246c1abb9f4857b3a7cb55155a7941b9631b49b Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in ember-velcro (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb2c22cbb7ab559c0ac1e61418ae224e561beacb9571166240b4c5249a098dbb Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-30048 Unauthenticated access to module configuration endpoint

The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication...

CVE-2025-30048

Technical details are not publicly available in the provided documents. Monitor for updates.

PT-2025-34849 · Unknown · Serverconfig

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: The serverConfig API endpoint returns the module configuration, including credentials, without requiring authentication. Recommendations: At the moment, there is no information about a newer versio...

CVE-2025-7426 MINOVA TTA Information Disclosure and Credential Exposure

Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environments where this FTP server is part of...

PT-2025-34675 · Unknown · Unified Pam

Name of the Vulnerable Software and Affected Versions: Unified PAM affected versions not specified Description: An authentication bypass allows unauthenticated attackers to control administrator backup functions. Successful exploitation can lead to the compromise of passwords, secrets, and...

CVE-2025-57734

In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files...

CVE-2025-55740

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

CVE-2025-52351

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL e.g., https://domain.com/activate=xyz. This practice can result in password exposure via...

PT-2025-34243 · WordPress · Eslint-Ban-Moment

Name of the Vulnerable Software and Affected Versions: eslint-ban-moment versions 3.0.0 and earlier Description: The eslint-ban-moment plugin exposes a sensitive Supabase URI in the .env file. A valid Supabase URI containing a username and password grants an attacker complete unauthorized access...

CVE-2025-43983

CVE-2025-43983 affects KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices. The vulnerability set involves unauthenticated access to goform/goform_set_cmd_process and goform/goform_get_cmd_process, enabling an attacker to retrieve sensitive information (including the admin username/password), modify cri...

PT-2025-33281 · Undefined · Undefined

KuWFi CPF908-CP5 WEB5.0 LCD 20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform set cmd process and goform/goform get cmd process. These allow an unauthenticated attacker to retrieve sensitive information including the device admin username and...

CVE-2025-40751

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.3. Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credential...