EUVD-2021-14708

Malware in sbrugna...

EUVD-2021-10846

Malware in sbrugna...

EUVD-2020-25242

Malware in sbrugna...

EUVD-2021-1244

Malware in sbrugna...

EUVD-2024-47764

Malicious code in bioql PyPI...

EUVD-2024-32073

Malicious code in bioql PyPI...

EUVD-2022-39013

Malicious code in bioql PyPI...

EUVD-2024-39998

Malicious code in bioql PyPI...

EUVD-2021-28338

Malicious code in bioql PyPI...

EUVD-2022-53110

Malicious code in bioql PyPI...

EUVD-2025-15829

Malicious code in bioql PyPI...

EUVD-2025-23891

Malicious code in bioql PyPI...

EUVD-2022-38600

Malicious code in bioql PyPI...

EUVD-2024-35429

Malicious code in bioql PyPI...

WordPress LatePoint plugin <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function vulnerability

Unauthenticated Authentication Bypass via loadstep Function vulnerability discovered by wesley wcraft in WordPress Plugin LatePoint versions = 5.1.94...

FlatPress <= 1.4.1 Multiple Vulnerabilities

FlatPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:flatpress:flatpress"; ifdescripti...

WordPress SupportCandy plugin <= 3.3.7 - Authentication Bypass to Support Session Takeover vulnerability

Authentication Bypass to Support Session Takeover vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin SupportCandy versions = 3.3.7...

WordPress Service Finder SMS System plugin <= 2.0.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Foxyyy in WordPress Plugin Service Finder SMS System versions = 2.0.0...

Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST

We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that...

CVE-2025-59036

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account...