EUVD-2025-23523

Malicious code in bioql PyPI...

EUVD-2025-21036

Malicious code in bioql PyPI...

EUVD-2025-14304

Malicious code in bioql PyPI...

EUVD-2023-12226

Malicious code in bioql PyPI...

EUVD-2024-0785

Malicious code in bioql PyPI...

EUVD-2024-32861

Malicious code in bioql PyPI...

EUVD-2023-53561

Malicious code in bioql PyPI...

EUVD-2022-32616

Malicious code in bioql PyPI...

EUVD-2023-27921

Malicious code in bioql PyPI...

EUVD-2023-41384

Malicious code in bioql PyPI...

EUVD-2024-39191

Malicious code in bioql PyPI...

CISO Spotlight: AJ Debole on the Business-Tech Divide, Breach Readiness, and AI Risks

AJ Debole is Field CISO at Oracle, but her journey began far from the corporate boardroom. After starting out in law and government, she moved into healthcare and cyber defense, where she led teams through ransomware crises. In this spotlight, she explores the next wave of challenges – aligning...

CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

MAL-2025-14644 Malicious code in api-security-test (npm)

The package api-security-test was found to contain malicious code...

Malicious code in api-security-test (npm)

The package api-security-test was found to contain malicious code...

CVE-2025-54554

tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure...

CVE-2025-44960

RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route...

CVE-2025-54554

tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure...

Insecure API Design: Able to Disable 2-Factor Authentication Without OTP or Backup Code

Description There is a minor issue in the 2-Factor Authentication 2FA flow. when a user tries to disable 2FA from the dashboard, the system should ask for a valid OTP or backup code and verify it through the following API: POST /api/auth/2fa/verify HTTP/1.1 Host: 127.0.0.1:3080 User-Agent:...

Debunking API Security Myths

I recently sat down with Tejpal Garwhal, Application Security and DevSecOps Leader, for a conversation debunking some of the most common API security myths. From zombie endpoints to the limits of WAFS and gateways, we covered what’s really happening on the ground; and what security teams need to ...