EUVD-2025-30637

Malicious code in bioql PyPI...

EUVD-2023-0600

Malicious code in bioql PyPI...

EUVD-2022-7737

Malicious code in bioql PyPI...

EUVD-2022-51010

Malicious code in bioql PyPI...

EUVD-2024-34530

Malicious code in bioql PyPI...

EUVD-2025-32049

Malicious code in bioql PyPI...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the validLogFileName and validExecOutputFileName functions, which insufficiently validate log file names, allowing traversal sequences after certain prefixes. An attacker can access sensitive files on the host...

Security update for warewulf4

This update for warewulf4 fixes the following issues: Update to version 4.6.4. Security issues fixed: CVE-2025-58058: xz: excessive memory consuption when unpacking a large number of corrupted LZMA archives bsc1248906. Other issues fixed: Convert disk booleans from wwbool to bool which allows boo...

Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs

The Computer Emergency Response Team of Ukraine CERT-UA has warned of new targeted cyber attacks in the country using a backdoor called CABINETRAT. The activity, observed in September 2025, has been attributed to a threat cluster it tracks as UAC-0245. The agency said it spotted the attack...

Cisco Firepower Threat Defense Software Encrypted Archive File Policy Bypass (cisco-sa-ftd-archive-bypass-z4wQjwcN)

A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. This vulnerability exists because of a...

Improper Access Control

contao/contao is vulnerable to Improper Access Control. The vulnerability is due to news feeds not filtering protected news archives, which allows an attacker to access and view restricted news items through the public RSS feed...

CVE-2025-58001

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through = 4.1.0...

State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability

Libraesva has released a security update to address a vulnerability in its Email Security Gateway ESG solution that it said has been exploited by state-sponsored threat actors. The vulnerability, tracked as CVE-2025-59689 , carries a CVSS score of 6.1, indicating medium severity. "Libraesva ESG i...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Entry::unpackinraw API and the Entry::allowexternalsymlinks control which defaults to true. An attacker can write files outside the intended extraction directory and perform an arbitrary file write which can...

CVE-2025-58001

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through = 4.1.0...

WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Compact Archives versions = 4.1.0...

CVE-2025-58001 WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through = 4.1.0...

CVE-2025-58001

CVE-2025-58001 is a Stored Cross-Site Scripting (XSS) vulnerability in the Compact Archives WordPress plugin (affected:

CVE-2025-58001 WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through = 4.1.0...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...