EUVD-2025-2671

Malicious code in bioql PyPI...

EUVD-2025-4610

Malicious code in bioql PyPI...

EUVD-2025-4107

Malicious code in bioql PyPI...

EUVD-2025-27617

Malicious code in bioql PyPI...

EUVD-2025-6939

Malicious code in bioql PyPI...

EUVD-2024-29343

Malicious code in bioql PyPI...

EUVD-2022-37792

Malicious code in bioql PyPI...

EUVD-2024-43173

Malicious code in bioql PyPI...

EUVD-2024-1325

Malicious code in bioql PyPI...

EUVD-2025-7017

Malicious code in bioql PyPI...

EUVD-2025-27765

Malicious code in bioql PyPI...

EUVD-2025-5503

Malicious code in bioql PyPI...

EUVD-2023-56988

Malicious code in bioql PyPI...

EUVD-2022-43593

Malicious code in bioql PyPI...

EUVD-2025-22403

Malicious code in bioql PyPI...

EUVD-2024-17695

Malicious code in bioql PyPI...

Server-Side Request Forgery (SSRF)

mautic/core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to missing validation of webhook destinations, which allows an attacker with webhook permissions to send crafted requests and potentially access internal services, bypassing firewalls...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the /mpl/port/ endpoint, which acts as an unauthenticated proxy. An attacker can access internal services and arbitrary...

GHSA-XJV7-6W92-42R7 marimo vulnerable to proxy abuse of /mpl/{port}/

Summary The /mpl// endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. Details From our understanding, this route is used internally to provide access to interactive matplotlib...

CVE-2025-10735

The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmitFormData. This makes it possible for unauthenticated attackers to make web requests to arbitrary location...