EUVD-2023-35299

Malicious code in bioql PyPI...

EUVD-2023-23465

Malicious code in bioql PyPI...

EUVD-2022-38876

Malicious code in bioql PyPI...

EUVD-2024-52720

Malicious code in bioql PyPI...

EUVD-2024-52434

Malicious code in bioql PyPI...

EUVD-2024-25077

Malicious code in bioql PyPI...

EUVD-2022-2407

Malicious code in bioql PyPI...

EUVD-2024-17417

Malicious code in bioql PyPI...

EUVD-2022-32013

Malicious code in bioql PyPI...

EUVD-2025-29150

Malicious code in bioql PyPI...

EUVD-2024-47375

Malicious code in bioql PyPI...

EUVD-2023-44427

Malicious code in bioql PyPI...

EUVD-2024-53231

Malicious code in bioql PyPI...

EUVD-2025-24653

Malicious code in bioql PyPI...

Lovable VDP: Low-privileged user can enable or disable Lovable AI for new projects in workspace

A vulnerability was discovered that allowed low-privileged users to enable or disable Lovable AI for new projects in a workspace. The vulnerability was caused by improper authorization, which enabled low-privileged users to modify the Lovable AI settings by replaying certain API endpoints...

Nextcloud: tabnabbing in roundcube webmail

A tab nabbing vulnerability was discovered in Roundcube webmail. This vulnerability allowed a malicious website opened in a new tab to access the initial tab and change its location. This could be exploited to perform phishing attacks...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

PT-2025-46742

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where a reserved XArray entry is not released following a failure during adapter allocation within the ice adapter new function. This can lead to...

CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, newuserisadmin. This is fixed in version...

CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, newuserisadmin. This is fixed in version...