EUVD-2025-8715

Malicious code in bioql PyPI...

EUVD-2023-35732

Malicious code in bioql PyPI...

EUVD-2024-2512

Malicious code in bioql PyPI...

EUVD-2022-34144

Malicious code in bioql PyPI...

EUVD-2022-51489

Malicious code in bioql PyPI...

EUVD-2025-15118

Malicious code in bioql PyPI...

EUVD-2023-42938

Malicious code in bioql PyPI...

EUVD-2022-25219

Malicious code in bioql PyPI...

CVE-2025-9895

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscrib...

CVE-2025-9889 ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery

The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmxactivateconnection function. This makes it possible for unauthenticated attackers to bind...

Unauthorized Access

Liferay Portal is vulnerable to Unauthorized Access. The vulnerability is due to improper access control because unauthenticated users guests can access files uploaded by object entries and stored in documentlibrary via direct URL...

CVE-2025-9808 The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure

The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues...

CVE-2025-9880

CVE-2025-9880 affects the WordPress plugin Side Slide Responsive Menu (versions

CVE-2025-55976

Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint...

CVE-2025-9627

The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on the oirlpluginoptions function. This makes it possible for unauthenticated attackers to modify plugin settings includi...

CVE-2025-8492 Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticat...

CVE-2025-49461 Zoom Workplace Clients - Cross-site Scripting

Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access...

CVE-2025-8268

The CVE-2025-8268 entry concerns the WordPress AI Engine plugin (versions up to 2.9.5) with a missing capability check in the rest_list and delete_files paths, enabling unauthenticated attackers to list and delete files uploaded by other users. Impact per sources: unauthorized access and data los...

CVE-2025-55944

Slink v1.4.9 allows stored cross-site scripting XSS via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users...

CVE-2025-55944

CVE-2025-55944 concerns Slink v1.4.9, where stored XSS can be triggered by crafted SVG uploads. The vulnerability arises when a user views the shared image in a new tab, allowing embedded JavaScript to execute for both authenticated and unauthenticated users. Technical specifics across connected ...