SUSE CVE-2026-13318

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

EUVD-2024-27006

Malicious code in bioql PyPI...

EUVD-2023-32754

Malicious code in bioql PyPI...

EUVD-2023-58028

Malicious code in bioql PyPI...

EUVD-2023-34034

Malicious code in bioql PyPI...

EUVD-2023-54621

Malicious code in bioql PyPI...

EUVD-2024-16547

Malicious code in bioql PyPI...

EUVD-2023-12713

Malicious code in bioql PyPI...

EUVD-2023-33558

Malicious code in bioql PyPI...

EUVD-2024-47792

Malicious code in bioql PyPI...

EUVD-2023-12744

Malicious code in bioql PyPI...

EUVD-2023-57820

Malicious code in bioql PyPI...

EUVD-2025-14636

Malicious code in bioql PyPI...

EUVD-2024-16177

Malicious code in bioql PyPI...

CVE-2025-9190

Cursor for macOS 15.4.1 is affected by a RunAsNode fuse misconfiguration that allows a local, unprivileged attacker to execute arbitrary code inheriting Cursor TCC permissions. Access to resources is limited to what the user previously granted; requesting other resources will prompt the user, pot...

CVE-2024-1051

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'titletag'. This makes it possibl...

CVE-2023-3999

The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and...

CVE-2022-29049

Jenkins promoted builds Plugin 873.v6149dbd64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name...

CVE-2025-40574

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0 HF0. Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to interact with the backupmanager service...

GHSA-F8C8-4PM7-W885 Cross-Site Request Forgery in CodeChecker API

Summary Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions. Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and...