EUVD-2022-4952

Malicious code in bioql PyPI...

EUVD-2024-2544

Malicious code in bioql PyPI...

EUVD-2022-6638

Malicious code in bioql PyPI...

EUVD-2022-44891

Malicious code in bioql PyPI...

EUVD-2022-4465

Malicious code in bioql PyPI...

EUVD-2023-44944

Malicious code in bioql PyPI...

EUVD-2022-5684

Malicious code in bioql PyPI...

EUVD-2022-4886

Malicious code in bioql PyPI...

EUVD-2023-2848

Malicious code in bioql PyPI...

EUVD-2024-2764

Malicious code in bioql PyPI...

EUVD-2024-0906

Malicious code in bioql PyPI...

EUVD-2022-3643

Malicious code in bioql PyPI...

EUVD-2023-53908

Malicious code in bioql PyPI...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Overview smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' via the searchitemctrlf functio...

CVE-2025-43718

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata such as GTSPDFEVersion of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated...

Hutool allows remote code execution (RCE) via the QLExpressEngine class

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution RCE via the QLExpressEngine class...

CVE-2025-56769

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution RCE via the QLExpressEngine class...

USN-7777-1 pcre2 vulnerability

It was discovered that PCRE2 incorrectly handled the Scan SubString verb. An attacker could possibly use this issue to cause applications using PCRE2 to expose sensitive information...

CVE-2025-56769

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution RCE via the QLExpressEngine class...

CVE-2025-56769

CVE-2025-56769 affects chinabugotech Hutool (hutool/ hutool-extra) prior to version 5.8.4 (and related advisories mention 5.8.40) due to insecure handling in the QLExpressEngine . The issue lets an attacker craft expressions that cause arbitrary method invocation, enabling potential remote code e...