EUVD-2025-10910

Malicious code in bioql PyPI...

EUVD-2021-28648

Malicious code in bioql PyPI...

EUVD-2025-10986

Malicious code in bioql PyPI...

EUVD-2025-20488

Malicious code in bioql PyPI...

CVE-2025-21445

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host...

CVE-2025-36630

CVE-2025-36630 affects Tenable Nessus on Windows, prior to version 10.8.5. A non‑administrative user could overwrite arbitrary local system files with log content, achieving SYSTEM privilege. Root cause details are not explicitly provided in the documents; exploitation status is not detailed. The...

SUSE CVE-2025-5981

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

CVE-2023-31414

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host syste...

CVE-2020-15794

A vulnerability has been identified in Desigo Insight All versions. Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system...

CVE-2025-46272

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system...

GO-2025-3608 Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events...

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Summary: A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. Details: The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customiz...

CVE-2024-22042

A vulnerability has been identified in Unicam FX All versions. The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host conhost.exe as a child process with SYSTEM privileges. This could be exploited by an attacker to...

XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

Venki Supravizio BPM 安全漏洞

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 18.0.1 and prior versions, which stems from the presence of an NTLM hash leak that allows an authenticated attacker to elevate privileges on the underlying host...

XML External Entity (XXE) Injection

org.fhir, ucum is vulnerable to XML External Entity XXE Injection. The vulnerability is due to XML parsing performed by the UcumEssenceService, which allows a malicious DTD tag in the XML to inject data from the host system...

Arbitrary File Read

github.com/siyuan-note/siyuan is vulnerable to Arbitrary File Read. The vulnerability is due to lack of proper validation on the path parameter in the /api/template/render endpoint, allows attackers to manipulate the path and access sensitive files on the host system...

Ucum-java has an XXE vulnerability in XML parsing

Impact XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can...