EUVD-2023-57783

Malicious code in bioql PyPI...

EUVD-2024-0006

Malicious code in bioql PyPI...

EUVD-2022-3401

Malicious code in bioql PyPI...

EUVD-2023-1262

Malicious code in bioql PyPI...

EUVD-2025-15821

Malicious code in bioql PyPI...

EUVD-2022-52017

Malicious code in bioql PyPI...

EUVD-2024-0229

Malicious code in bioql PyPI...

DEBIAN-CVE-2025-27236

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...

PT-2025-40516

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description A standard Zabbix user lacking the necessary permissions for the Monitoring - Problems view can still execute the problem.view.refresh action, allowing them to retrieve a list of active...

GHSA-Q82V-H4RQ-5C86 Rancher update on users can deny the service to the admin

Impact A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically: - Username takeover: A user wit...

Missing Authorization

Mattermost Confluence Plugin is vulnerable to Missing Authorization. The vulnerability is due to missing access validation caused by failure to check user permissions when creating channel subscriptions via the API...

Incorrect Authorization

Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Incorrect Authorization due to table access voter improper verification of a user permissions to...

GHSA-7M47-R75R-CX8V Contao applies improper access control in the back end voters

Impact The table access voter in the back end doesn't check if a user is allowed to access the corresponding module. Patches Update to Contao 5.3.38 or 5.6.1. Workarounds Do not rely solely on the voter and additionally check USERCANACCESSMODULE. For more information If you have any questions or...

CVE-2025-8672

MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control TCC permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application...

Improper Authorization

@haxtheweb/haxcms-nodejs and elmsln/haxcms are vulnerable to Improper Authorization. The vulnerability is due to failure to verify if an authenticated user has permission to interact with a resource before performing operations...

CVE-2025-54832

OPEXUS FOIAXpress Public Access Link PAL, version v11.1.0, allows an authenticated user to add entries to the list of states and territories...

CVE-2025-54585 GitProxy is vulnerable to a new branch approval exploit

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations...

HAX CMS API Lacks Authorization Checks

Summary The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. Details The API endpoints within the HAX CMS...

CVE-2025-43976

The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component...

CVE-2025-6585 WP JobHunt <= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion

The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the csremoveprofilecallback function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...