EUVD-2025-16121

Malicious code in bioql PyPI...

EUVD-2024-0838

Malicious code in bioql PyPI...

EUVD-2023-0239

Malicious code in bioql PyPI...

EUVD-2022-3007

Malicious code in bioql PyPI...

EUVD-2024-54105

Malicious code in bioql PyPI...

EUVD-2024-20639

Malicious code in bioql PyPI...

EUVD-2025-19795

Malicious code in bioql PyPI...

EUVD-2024-44858

Malicious code in bioql PyPI...

EUVD-2023-45766

Malicious code in bioql PyPI...

EUVD-2022-5743

Malicious code in bioql PyPI...

EUVD-2023-55565

Malicious code in bioql PyPI...

EUVD-2022-4980

Malicious code in bioql PyPI...

text-generation-inference: Unbounded external image fetch in validation leads to resource-exhaustion DoS

Description Text Generation Inference Router DoS via pre-validation image fetch in VLM mode. Affected: Router workspace version 3.3.6 the latest repo, when deployed with a vision/VLM model e.g., Idefics/Mllama/Idefics2/Idefics3/Gemma3/Llama4/Paligemma/LlavaNext/Qwen2VL/Qwen25VL. Pure text LLMs do...

Cross-site Scripting (XSS)

Overview behavex is an Agile testing framework on top of Behave BDD. Affected versions of this package are vulnerable to Cross-site Scripting XSS via when rendering step.text in the HTML report template. An attacker can inject arbitrary HTML or JavaScript in the context of a user's browser by...

A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.

...

UBUNTU-CVE-2025-39894

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

CVE-2025-7038

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the stepsloadstep route of the latepointroutecall AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and relate...

CVE-2025-7038

The vulnerability CVE-2025-7038 affects LatePoint for WordPress (up to v5.1.94). The issue is an Authentication Bypass in the steps__load_step path of the latepoint_route_call AJAX endpoint, where client-supplied customer email/fields are used before login verification or nonce checks. Unauthenti...

Automated Vulnerability Validation and Verification: A Large Language Model Approach

Software vulnerabilities remain a critical security challenge, providing entry points for attackers into enterprise networks. Despite advances in security practices, the lack of high-quality datasets capturing diverse exploit behavior limits effective vulnerability assessment and mitigation. This...

Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication during OTP validation. An attacker can gain unauthorized access by reusing a valid time-based one-time password within its validity period. Remediation Upgrade...