EUVD-2022-28986

Malicious code in bioql PyPI...

EUVD-2025-32290

Malicious code in bioql PyPI...

EUVD-2022-40850

Malicious code in bioql PyPI...

EUVD-2025-4989

Malicious code in bioql PyPI...

EUVD-2023-59418

Malicious code in bioql PyPI...

EUVD-2023-28708

Malicious code in bioql PyPI...

EUVD-2023-44620

Malicious code in bioql PyPI...

EUVD-2025-24460

Malicious code in bioql PyPI...

EUVD-2025-25657

Malicious code in bioql PyPI...

EUVD-2025-26158

Malicious code in bioql PyPI...

EUVD-2022-15978

Malicious code in bioql PyPI...

grafana-pcp security update

An update is available for grafana-pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...

Hitachi Pentaho Business Analytics Server 8.3.x < 9.3.0.2 / 9.4.x < 9.4.0.1 Remote Code Execution

Hitachi Pentaho Business Analytics Server versions 8.3.x prior to 9.3.0.2 or 9.4.x prior to 9.4.0.1 suffer from a remote code execution vulnerability. An attacker can exploit this issue by sending a specially crafted HTTP request to the affected application. A successful exploit could allow the...

CVE-2025-40646

CVE-2025-40646 describes a Stored Cross-Site Scripting (XSS) in Energy CRM v2025 by Status Tracker Ltd. The vulnerability arises from insufficient validation of user input in a POST to /crm/create_job_submit.php, using the JobCreatedBy parameter. An attacker could craft a request that, when viewe...

CVE-2025-28357

A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request...

CVE-2025-11030

A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. The manipulation results in improper authorization. The atta...

CVE-2025-10987 YunaiV yudao-cloud HTTP Request transfer improper authorization

A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate t...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

CVE-2025-10815

A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. T...

The vulnerability of the Q-Free MaxTime traffic light control software lies in the improper limitation of the path name in the directory structure, allowing a violator to gain unauthorized access to protected information.

The vulnerability of the Q-Free MaxTime traffic light management software is related to an incorrect restriction on the path name for the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a...