CVE-2025-40676 Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC

Insecure Direct Object Reference IDOR in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure BBMRI-ERIC. This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in...

EUVD-2018-17038

Malware in sbrugna...

EUVD-2021-26244

Malware in sbrugna...

EUVD-2013-4207

Malware in sbrugna...

EUVD-2014-0263

Malware in sbrugna...

EUVD-2021-19515

Malware in sbrugna...

EUVD-2020-18350

Malware in sbrugna...

EUVD-2022-38837

Malicious code in bioql PyPI...

EUVD-2025-28981

Malicious code in bioql PyPI...

EUVD-2025-25308

Malicious code in bioql PyPI...

EUVD-2022-26446

Malicious code in bioql PyPI...

EUVD-2023-56164

Malicious code in bioql PyPI...

EUVD-2024-33946

Malicious code in bioql PyPI...

EUVD-2024-43136

Malicious code in bioql PyPI...

EUVD-2024-2546

Malicious code in bioql PyPI...

EUVD-2022-7155

Malicious code in bioql PyPI...

CVE-2025-9209

The CVE concerns RestroPress – Online Food Ordering System (WordPress) versions 3.0.0–3.1.9.2. Affected endpoint /wp-json/wp/v2/users exposes user private tokens and API data, enabling unauthenticated attackers to forge JWT tokens and authenticate as other users (including admins). This constitut...

EUVD-2025-32281

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated...

Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

Impact In LXD's devLXD server, the source container identification process uses process cmdline command line information, allowing attackers to impersonate other containers by spoofing process names. The core issue lies in the findContainerForPID function in lxd/apidevlxd.go. This function...

CVE-2025-59843 FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/username returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public AP...