EUVD-2025-6003

Malicious code in bioql PyPI...

CVE-2025-27501

CVE-2025-27501 describes an unauthenticated SSRF in OpenZiti Console where an admin-panel endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller, enabling server-side requests. Root cause: server-side request is triggered using a node’s identity via the parameter. Imp...

CVE-2025-27500

CVE-2025-27500 affects OpenZiti Console. An unauthenticated POST to the admin endpoint /api/upload can upload files stored on the node, which can be accessed to trigger a stored XSS when viewed in a user’s browser. The issue is tied to the legacy node-server behavior of the admin panel; the funct...

CVE-2025-27500 Cross Site Scripting potential in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint/api/upload on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL...