CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

GHSA-2Q7R-29RG-6M5H fastify-reply-from affected by bypass of reply forwarding

Summary By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. Details An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl...

CVE-2025-62584

CVE-2025-62584 affects Naver Whale Browser prior to version 4.33.325.17 and describes a bypass of the Same-Origin Policy in a dual-tab environment. The available connected documents consistently state that the issue enables an attacker to bypass SOP between tabs, but they do not provide concrete ...

Microsoft Windows Remote Desktop Services 授权问题漏洞

Microsoft Windows Remote Desktop Services is a collection of features from Microsoft Corporation USA that allow users to remotely access graphical desktops and Windows applications. An authorization issue vulnerability exists in Microsoft Windows Remote Desktop Services that stems from an...

EUVD-2003-1004

Malware in sbrugna...

EUVD-2020-3133

Malware in sbrugna...

EUVD-2019-15028

Malware in sbrugna...

EUVD-2013-0991

Malware in sbrugna...

EUVD-2012-3697

Malware in sbrugna...

EUVD-2017-11284

Malware in sbrugna...

EUVD-2017-14312

Malware in sbrugna...

EUVD-2009-2760

Malware in sbrugna...

EUVD-2023-35556

Malicious code in bioql PyPI...

EUVD-2022-36674

Malicious code in bioql PyPI...

New WireTap Attack Extracts Intel SGX ECDSA Key via DDR4 Memory-Bus Interposer

In yet another piece of research, academics from Georgia Institute of Technology and Purdue University have demonstrated that the security guarantees offered by Intel's Software Guard eXtensions SGX can be bypassed on DDR4 systems to passively decrypt sensitive data. SGX is designed as a hardware...

CVE-2025-9495

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attack...

CVE-2025-56689

One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password OTP/Multifactor Authentication MFA bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying th...

Liferay Portal和Liferay DXP 代码问题漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-49082

CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read other settings. The attack...

CVE-2024-5868

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...