EUVD-2025-25055

Malicious code in bioql PyPI...

EUVD-2025-27108

Malicious code in bioql PyPI...

EUVD-2025-25397

Malicious code in bioql PyPI...

PT-2025-40573

Name of the Vulnerable Software and Affected Versions HCL MyXalytics version 6.6 Description A flaw exists in HCL MyXalytics that permits HTML injection. This could potentially allow an attacker to inject malicious HTML code into the application. Recommendations At the moment, there is no...

CVE-2025-61604 WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` Endpoint

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CSRF vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger...

netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

A flaw in Netty’s HTTP/1.1 chunked encoding parser allows newline LF characters in chunk extensions to be incorrectly treated as the end of the chunk-size line instead of requiring the proper CRLF sequence. This discrepancy can be exploited in rare cases where a reverse proxy interprets the same...

netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability

A flaw was found in Netty where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts...

netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability

A flaw was found in Netty where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts...

PT-2025-40425

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.4.12 and below Description WeGIA, a web manager designed for charitable institutions, is susceptible to a Cross-Site Request Forgery CSRF issue. The deletion function for the Almoxarifado entity is accessible through an HTTP G...

TLoRa: Implementing TLS over LoRa for Secure HTTP Communication in IoT

We present TLoRa, an end-to-end architecture for HTTPS communication over LoRa by integrating TCP tunneling and a complete TLS 1.3 handshake. It enables a seamless and secure communication channel between WiFi-enabled end devices and the Internet over LoRa using an End Hub EH and a Net Relay NR...

ROS-20251002-03

A vulnerability in Microsoft's .NET software platform is related to the closing of the HTTP/3 stream while writing code for an application, resulting in a race condition in response. Exploitation of the vulnerability could allow an attacker, acting remotely, to gain access to sensitive informatio...

SUSE CVE-2025-11211

Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-10859

An information disclosure vulnerability exists in Mozilla Firefox for iOS due to the incorrect sharing of cookie storage for non-HTML temporary documents with normal browsing content. This flaw allows sensitive information from private tabs to escape Incognito mode , persisting even after the use...

CVE-2025-10342

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'...

HTTP Request Smuggling

eventlet is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper handling of HTTP trailer sections, which allows an attacker to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches...

CVE-2025-10346

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledgebase/article'...

CVE-2025-10346 HTML injection in Perfex CRM

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledgebase/article'...

The vulnerability of the library for working with XML and HTML files, libxml2, is related to buffer overflows in the stack. This allows an attacker to execute arbitrary code.

The vulnerability of the libxml2 library for analyzing XML files is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability in the web server of microprogramming-based network interface controllers of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) for operating systems Cisco IOS, Cisco IOS XR, and Cisco IOS XE allows a attacker to cause service interruptions.

The vulnerability of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD web servers’ microprogramming-based network interface controllers in Cisco IOS, Cisco IOS XR, and Cisco IOS XE operating systems is related to buffer overflow in dynamic memory. Exploiting this...

The vulnerability in the web-server-based VPN microprogramming system of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD VPN microprogramming devices lies in the absence of authentication. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of protected information by...