EUVD-2025-25855

Malicious code in bioql PyPI...

EUVD-2025-25473

Malicious code in bioql PyPI...

EUVD-2025-24609

Malicious code in bioql PyPI...

EUVD-2025-24608

Malicious code in bioql PyPI...

CVE-2025-34211

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA and SaaS deployments contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname pl‑local.com and is used by the...

mysql: Optimizer unspecified vulnerability (CPU Jul 2025)

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with network access via multiple protocols to cause a crash in the MySQL server...

Malicious code in across-indexer-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8fef241ea15f212acce31cd8bcc9d561a7f8a55c8367d778cca91c189d8a3a7 The OpenSSF Package Analysis project identified 'across-indexer-monorepo' @ 7.1.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-47511 Malicious code in across-indexer-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8fef241ea15f212acce31cd8bcc9d561a7f8a55c8367d778cca91c189d8a3a7 The OpenSSF Package Analysis project identified 'across-indexer-monorepo' @ 7.1.1 npm as malicious. It is considered malicious because: - The...

Malicious code in across-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9dcdfc6a9dc7db63bf70744266f75c8200349bb4332b36dbc8319caa1df15e31 The OpenSSF Package Analysis project identified 'across-toolkit' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-47512 Malicious code in across-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9dcdfc6a9dc7db63bf70744266f75c8200349bb4332b36dbc8319caa1df15e31 The OpenSSF Package Analysis project identified 'across-toolkit' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

Liferay Portal and DXP allows users to add a note to a different virtual instance

Insecure Direct Object Reference IDOR vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a...

CVE-2025-34198

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 VA and SaaS deployments contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys RSA, ECDSA, and ED25519 are present across...

CVE-2025-34198

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 VA and SaaS deployments contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys RSA, ECDSA, and ED25519 are present across...

Shai-Hulud npm Worm

Shai-Hulud is a self-replicating worm targeting the npm ecosystem. Once it compromises a developer machine or CI/CD runner, it harvests secrets and uses them to republish itself across multiple npm packages within hours. This advisory holds IoCs and further information...

AZL-71242 CVE-2023-53254 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix sharedcpumap to handle shared caches at different levels The cacheinfo sets up the sharedcpumap by checking whether the caches with the same index are shared between CPUs. However, this will trigger...

CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

PT-2025-37841

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7 iPadOS versions prior to 18.7 macOS versions prior to Tahoe 26 tvOS versions prior to 26 watchOS versions prior to 26 visionOS versions prior to 26 Description An out-of-bounds access issue existed due to insufficien...

PT-2025-37782

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.8 macOS Sequoia versions prior to 15.7 macOS Tahoe versions prior to 26 tvOS versions prior to 26 watchOS versions prior to 26 iOS versions prior to 26 iPadOS versions prior to 26 Description: An authorizatio...

CVE-2025-21037

Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability...

FreePBX api 信任管理问题漏洞

FreePBX api is an open source plug-in for FreePBX. A trust management issue vulnerability exists in FreePBX api versions prior to 15.0.13, 16.0.2 through 16.0.14, and 17.0.1 through 17.0.2, which stems from the use of the same OAuth private key on multiple systems, which could lead to bypassing...