CVE-2026-71251

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2025-32781

CVE-2025-32781 affects Apollo Portal prior to 2.5.0, where an authenticated user can request a release by ID (GET /envs/{env}/releases/{releaseId}) with configView.memberOnly.envs enabled and read configuration data from other applications/namespaces. Root cause: missing application/namespace per...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper access control to OpenAPI. An attacker can retrieve sensitive OpenAPI YAML files by sending a specially crafted URL. Remediation Upgrade com.liferay:com.liferay.portal.security.auth.verifier to...

EUVD-2009-4123

Malware in sbrugna...

EUVD-2018-11940

Malware in sbrugna...

EUVD-2020-5697

Malware in sbrugna...

EUVD-2021-15689

Malware in sbrugna...

EUVD-2004-2503

Malware in sbrugna...

EUVD-2018-5328

Malware in sbrugna...

EUVD-2018-12024

Malware in sbrugna...

EUVD-2017-10233

Malware in sbrugna...

EUVD-2024-0781

Malicious code in bioql PyPI...

EUVD-2023-44092

Malicious code in bioql PyPI...

EUVD-2025-10388

Malicious code in bioql PyPI...

EUVD-2025-23958

Malicious code in bioql PyPI...

EUVD-2024-49203

Malicious code in bioql PyPI...

EUVD-2023-48665

Malicious code in bioql PyPI...

EUVD-2022-48127

Malicious code in bioql PyPI...

EUVD-2024-47825

Malicious code in bioql PyPI...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter. An attacker can access audit events belonging to a different virtual instance by specifying the identifi...