EUVD-2024-45934

Malicious code in bioql PyPI...

EUVD-2025-5448

Malicious code in bioql PyPI...

EUVD-2024-49601

Malicious code in bioql PyPI...

EUVD-2025-24446

Malicious code in bioql PyPI...

EUVD-2024-34994

Malicious code in bioql PyPI...

EUVD-2024-39424

Malicious code in bioql PyPI...

EUVD-2023-36567

Malicious code in bioql PyPI...

EUVD-2025-30331

Malicious code in bioql PyPI...

EUVD-2024-29841

Malicious code in bioql PyPI...

EUVD-2025-28477

Malicious code in bioql PyPI...

Server-Side Request Forgery (SSRF)

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the improper use of the next function without explicitly passing the request object, which allows an attacker to exploit incorrectly forwarded user-supplied headers in self-hosted applications...

FreshRSS 代码问题漏洞

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A code issue vulnerability exists in FreshRSS 1.26.3 and prior versions that stems from a failure to properly terminate a session when logging out, which could lead to session hijacking and fixed vulnerabilities...

PT-2025-39920

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS is susceptible to a double clickjacking protection bypass. An attacker can trick an administrator into promoting themselves to "admin" and logging into other users' accounts. This is...

CVE-2025-59344

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-34205

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 VA and SaaS deployments contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php found in several containers...

CVE-2025-59344

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...

Security Bulletin: IBM Watsonx BI is affected by a vulnerability found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic.

Summary Watsonx BI has a vulnerability found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity...

CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...