EUVD-2022-1894

Malicious code in bioql PyPI...

EUVD-2024-22493

Malicious code in bioql PyPI...

EUVD-2023-28094

Malicious code in bioql PyPI...

EUVD-2022-42814

Malicious code in bioql PyPI...

EUVD-2023-48171

Malicious code in bioql PyPI...

EUVD-2023-1976

Malicious code in bioql PyPI...

EUVD-2022-34343

Malicious code in bioql PyPI...

EUVD-2022-5842

Malicious code in bioql PyPI...

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

The Element Plus UI component library (NPM) is vulnerable to insufficient input validation in the el-link component through version 2.10.6 . The component fails to perform protocol validation, URL sanitization, or security header enforcement on user-controlled href attributes, passing them direct...

PT-2025-36908

Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...

Linux Distros Unpatched Vulnerability : CVE-2020-4048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In affected versions of WordPress, due to an issue in wpvalidateredirect and URL sanitization, an arbitrary external link can be crafted leading to...

CVE-2025-54382

Cherry Studio (desktop client) version 1.5.1 is affected by an RCE vulnerability when connecting to streamableHttp MCP servers due to the server’s implicit trust in OAuth redirection URLs and improper URL sanitization. The issue is mitigated by upgrading to version 1.5.2. Exploitation status is n...

CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure

Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...

DRUPAL-CONTRIB-2025-095

This module enables you to provide SEO analysis and recommendations for a given URL. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery SSRF vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

CVE-2025-26394

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required...

CVE-2025-26394

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required...

CVE-2025-26394

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required...

CVE-2025-26394 SolarWinds SWOSH Open Redirection Vulnerability

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required...

The vulnerability of the recvUpgradeNewFw() function in TOTOLINK CA600-PoE router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the recvUpgradeNewFw function in TOTOLINK CA600-PoE router microprogramming software is related to the lack of measures taken to clean data at the management level when processing the fwUrl parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...