EUVD-2025-29070

Malicious code in bioql PyPI...

EUVD-2025-15092

Malicious code in bioql PyPI...

EUVD-2025-32061

Malicious code in bioql PyPI...

CVE-2025-34210

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA/SaaS deployments store a large number of sensitive credentials database passwords, MySQL root password, SaaS keys, Portainer admin password, etc. in cleartext files that are world-readable. Any local user - or any proces...

CVE-2025-59745

Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily crack...

VMware Aria Operations Information Disclosure Vulnerability

VMware Aria Operations is a unified, artificial intelligence-driven, self-driving IT operations management platform for private, hybrid and multi-cloud environments from VMware. VMware Aria Operations has a security vulnerability that could be exploited by an attacker to disclose other users'...

CVE-2025-34233

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a protection mechanism failure vulnerability within the filegetcontents function. When an administrator configures a printer’s hostname or...

CVE-2025-10879

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication...

PT-2025-39703

Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.11.0.0 and 2.11.0.0 Description The IBM Storage TS4500 Library is susceptible to a cross-site scripting issue. An unauthenticated attacker can inject arbitrary JavaScript code into the Web UI, potentially...

CVE-2025-10360 Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

CVE-2025-47698

An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure...

CVE-2025-34200

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to...

CVE-2025-47698

CVE-2025-47698 affects Cognex In‑Sight devices (In‑Sight Explorer and related firmware). An adjacent, unauthenticated attacker can extract credentials that are present during the firmware upgrade procedure, facilitated by a hard‑coded password embedded in publicly available software. Impact per s...

CVE-2025-34185

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'dblog' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials...

Cognex In-Sight Explorer and Cognex In-Sight Camera Firmware have security vulnerabilities

Cognex In-Sight Explorer and Cognex In-Sight Camera Firmware are both products of Cognex Corporation, U.S.A. Cognex In-Sight Explorer is a tool that has the ability to debug and program the software of its line of smart cameras.Cognex In-Sight Camera Firmware is firmware for a range of smart...

Cognex’s various products have security vulnerabilities

Cognex In-Sight Explorer and Cognex In-Sight Camera Firmware are both products of Cognex Corporation, U.S.A. Cognex In-Sight Explorer is a tool that has the ability to debug and program the software of its line of smart cameras.Cognex In-Sight Camera Firmware is firmware for a range of smart...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the Proxy authentication. An attacker can obtain sensitive authentication information by exploiting differences in response times during password validation. Remediation Upgrade...

Ilevia EVE X1 Server security vulnerabilities

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A security vulnerability exists in Ilevia EVE X1 Server version 4.7.18.0.eden and prior versions, which stems from the presence of a pre-authenticated file leak in the dblog parameter, which could lead to a remote...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

CVE-2025-50110

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...