EUVD-2025-28581

Malicious code in bioql PyPI...

EUVD-2024-49169

Malicious code in bioql PyPI...

EUVD-2025-23968

Malicious code in bioql PyPI...

EUVD-2025-27232

Malicious code in bioql PyPI...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate 5.13.2 and earlier versions, which stems from the presence of an open redirect in the redir parameter that could result in a redirect to an attacker-controlled site...

CVE-2025-57872

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

CVE-2025-57872

The CVE-2025-57872 entry concerns Esri Portal for ArcGIS 11.4 and earlier, which contains an unvalidated redirect vulnerability. An unauthenticated remote attacker could craft a URL that redirects victims to an attacker‑controlled site, potentially enabling phishing. Public details across sources...

CVE-2025-57879 BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

PT-2025-39865

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description An unvalidated redirect issue exists in Esri Portal for ArcGIS. A remote, unauthenticated attacker can create a malicious URL that redirects a user to an arbitrary website, potentially...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via improper handling of caches. An attacker can obtain unauthorized access to sensor information by tricking a user into visiting a malicious website. This is only exploitable if the system is configured with certain...

WordPress plugin WP Gravity Forms Keap/Infusionsoft 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An input...

CVE-2025-43356

A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches. Mitigation Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the...

Ongoing FileFix Attack Installs StealC Infostealer Via Fake Facebook Pages

Researchers spot FileFix phishing sites that deliver StealC Infostealer through fake Facebook warnings and hidden payloads in images...

The vulnerability of the built-in software of the PLC Fastwel involves redirecting URLs to an unreliable website, allowing a hacker to redirect users to any given URL address.

The vulnerability in the built-in software of the PLC Fastwel relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses remotely...

CVE-2025-43327

The issue was addressed by adding additional logic. This issue is fixed in Safari 26. Visiting a malicious website may lead to address bar spoofing...

Mattermost Open Redirect vulnerability

Mattermost versions 10.5.x = 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs...

CVE-2025-9084 Open redirect in OAuth login

Mattermost versions 10.5.x = 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs...

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are the target of a search engine optimization SEO poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet...

CVE-2025-10193 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...

Bridging the Gap in Phishing Detection: a Comprehensive Phishing Dataset Collector

To combat phishing attacks -- aimed at luring web users to divulge their sensitive information -- various phishing detection approaches have been proposed. As attackers focus on devising new tactics to bypass existing detection solutions, researchers have adapted by integrating machine learning a...