Astro's `X-Forwarded-Host` is reflected without validation

Summary When running Astro in on-demand rendering mode using a adapter such as the node adapter it is possible to maliciously send an X-Forwarded-Host header that is reflected when using the recommended Astro.url property as there is no validation that the value is safe. Details Astro reflects th...

CVE-2025-61925

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...

EUVD-2015-5019

Malware in sbrugna...

EUVD-2017-8213

Malware in sbrugna...

EUVD-2016-4553

Malware in sbrugna...

EUVD-2019-12372

Malware in sbrugna...

EUVD-2012-0289

Malware in sbrugna...

EUVD-2006-6520

Malware in sbrugna...

EUVD-2006-6456

Malware in sbrugna...

EUVD-2015-2663

Malware in sbrugna...

EUVD-2010-0138

Malware in sbrugna...

EUVD-2025-24911

Malicious code in bioql PyPI...

EUVD-2025-24910

Malicious code in bioql PyPI...

EUVD-2022-3788

Malicious code in bioql PyPI...

EUVD-2025-25235

Malicious code in bioql PyPI...

EUVD-2023-32387

Malicious code in bioql PyPI...

From threats to apology, hackers pull child data offline after public backlash

Last week we yelled at some “hackers” that threatened parents after stealing data from their children's nursery. This followed a BBC report that a group calling itself “Radiant” claimed to have stolen sensitive data related to around 8,000 children from nursery chain Kido, which operates in the U...

Hackers threaten parents: Get nursery to pay ransom or we leak your child’s data

Just when you think extortionists can’t sink any lower, along comes a lowlife that manages to surprise you. The BBC reported that a group calling itself "Radiant" claims to have stolen sensitive data related to around 8,000 children from nursery chain Kido, which operates in the UK, US, China, an...

CVE-2025-58435

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...