CVE-2026-39967

TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data user answers, variable values from a different typebot by supplying a foreign resultId to the startChat...

CVE-2026-29055 Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A...

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...

CVE-2026-25757

Spree (Ruby on Rails) is affected prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2. The root cause is that the OrdersController#show endpoint allows unauthenticated access to view completed guest orders by Order ID, and authorize_access does not enforce proper authorization for guest orders. Thi...

CVE-2021-33981

An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses...

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

CVE-2025-10450

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional Core Libraries allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1...

EUVD-2016-2055

Malware in sbrugna...

EUVD-2020-30109

Malware in sbrugna...

EUVD-2021-10011

Malware in sbrugna...

EUVD-2021-2535

Malware in sbrugna...

EUVD-2025-21174

Malicious code in bioql PyPI...

EUVD-2023-31272

Malicious code in bioql PyPI...

EUVD-2025-16378

Malicious code in bioql PyPI...

EUVD-2024-27421

Malicious code in bioql PyPI...

EUVD-2024-16901

Malicious code in bioql PyPI...

EUVD-2023-37824

Malicious code in bioql PyPI...

EUVD-2024-54008

Malicious code in bioql PyPI...

EUVD-2023-34167

Malicious code in bioql PyPI...

CVE-2025-53765

CVE-2025-53765 (Azure Stack Hub Information Disclosure Vulnerability) affects Azure Stack Hub deployments, enabling a local attacker to disclose private personal information due to improper access control. The issue concerns local access to data on Azure Stack Hub and is characterized by informat...