EUVD-2022-15830

Malicious code in bioql PyPI...

EUVD-2021-27507

Malicious code in bioql PyPI...

EUVD-2024-22140

Malicious code in bioql PyPI...

EUVD-2024-39581

Malicious code in bioql PyPI...

EUVD-2021-28009

Malicious code in bioql PyPI...

EUVD-2025-10101

Malicious code in bioql PyPI...

EUVD-2022-46910

Malicious code in bioql PyPI...

EUVD-2023-59151

Malicious code in bioql PyPI...

EUVD-2025-17596

Malicious code in bioql PyPI...

EUVD-2025-20349

Malicious code in bioql PyPI...

EUVD-2025-4637

Malicious code in bioql PyPI...

EUVD-2025-14341

Malicious code in bioql PyPI...

EUVD-2021-31599

Malicious code in bioql PyPI...

EUVD-2021-8754

Malicious code in bioql PyPI...

EUVD-2021-31596

Malicious code in bioql PyPI...

ROS-20250923-16

Vulnerability in Zabbix universal monitoring system is related to incorrect authorization check in the hostprototype.get method in Zabbix API. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information. remotely to gain access to...

CVE-2025-10489

CVE-2025-10489 SureForms (WordPress) — Vulnerable to unauthorized form creation due to a missing capability check in register_post_types() for all versions up to 1.12.0. Authenticated attackers with Contributor-level access and above can create forms even when the UI blocks it. Impact per availab...

GHSA-JJ4J-X5WW-CWH9 Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

Summary Certain bulk action calls with a beforetransaction hook and no aftertransaction hook, will call the beforetransaction hook before authorization is checked and a Forbidden error is returned, when called as a bulk action. The impact is that a malicious user could cause a beforetransaction t...

Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

Summary Certain bulk action calls with a beforetransaction hook and no aftertransaction hook, will call the beforetransaction hook before authorization is checked and a Forbidden error is returned, when called as a bulk action. The impact is that a malicious user could cause a beforetransaction t...

CVE-2025-10040

The CVE-2025-10040 entry concerns the WordPress plugin WP Import – Ultimate CSV XML Importer. Affected: plugin versions up to 7.27. Issue: missing capability check on the get_ftp_details AJAX action, enabling authenticated users with Subscriber-level access and above to disclose configured SFTP/F...