EUVD-2023-25776

Malicious code in bioql PyPI...

EUVD-2024-37938

Malicious code in bioql PyPI...

EUVD-2023-30208

Malicious code in bioql PyPI...

EUVD-2022-6666

Malicious code in bioql PyPI...

EUVD-2024-33892

Malicious code in bioql PyPI...

EUVD-2025-12983

Malicious code in bioql PyPI...

EUVD-2024-54818

Malicious code in bioql PyPI...

EUVD-2021-6950

Malicious code in bioql PyPI...

EUVD-2023-36450

Malicious code in bioql PyPI...

EUVD-2023-2949

Malicious code in bioql PyPI...

CVE-2025-11226

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program...

CVE-2025-11226 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program...

WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Netgsm versions = 2.9.69...

GHSA-4XH5-X5GV-QWPH pip's fallback tar extraction doesn't check symbolic links point to extraction directory

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python versi...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the Commerce component assigning guest view permissions to uploaded virtual products in Documents and Media. An attacker can access and download virtual products without...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the gRPC API and HTTP APIs, which allow peers to send requests that cause the recipient to create files in arbitrary file system locations and read arbitrary files. An attacker can access sensitive data or execu...

GHSA-HX2H-VJW2-8R54 DragonFly has weak integrity checks for downloaded files

Impact The DragonFly2 uses a variety of hash functions, including the MD5 hash. This algorithm does not provide collision resistance; it is secure only against preimage attacks. While these security guarantees may be enough for the DragonFly2 system, it is not completely clear if there are any...

Linux Distros Unpatched Vulnerability : CVE-2022-50332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - video/aperture: Call sysfbdisable before removing PCI devices Call sysfbdisable from apertureremoveconflictingpcidevices before removing PCI devices. Without,...

PT-2025-37851

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7 iPadOS versions prior to 18.7 iOS versions prior to 26 iPadOS versions prior to 26 Description An application may be able to monitor keystrokes without user permission due to improved checks. Recommendations Update t...

CVE-2025-58751

A path traversal vulnerability has been identified in Vite’s static file serving logic, where files outside of the intended public directory may be served if their names share the same prefix or if symlinks are used to traverse upwards in the filesystem. An attacker could exploit this by placing ...