EUVD-2021-28296

Malicious code in bioql PyPI...

EUVD-2022-28589

Malicious code in bioql PyPI...

EUVD-2022-7087

Malicious code in bioql PyPI...

EUVD-2023-0593

Malicious code in bioql PyPI...

EUVD-2023-31327

Malicious code in bioql PyPI...

EUVD-2024-29844

Malicious code in bioql PyPI...

EUVD-2024-0416

Malicious code in bioql PyPI...

EUVD-2023-26621

Malicious code in bioql PyPI...

EUVD-2023-2155

Malicious code in bioql PyPI...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper processing of large name constraint structures in PKIXCertPathReviewer. An attacker can cause excessive resource allocation by submitting specially crafted ASN.1...

PT-2025-32220 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: An unrestricted file upload issue exists in Vedo Suite version 2024.17. Remote authenticated attackers can write to arbitrary filesystem paths by exploiting the insecure uploadPreviews custom function i...

PT-2025-28652 · Unknown · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System version 1.0 Description: A critical issue has been found in the code-projects Chat System, affecting some unknown functionality of the file /user/send message.php. The manipulation of the msg argument leads to SQL...

PT-2025-28153 · Langgenius · Dify

Name of the Vulnerable Software and Affected Versions: langgenius/dify versions 1.1.0 through 1.1.2 Description: The issue arises from unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. This is due to the ability to override global functions in...

Improper Authorization

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Improper Authorization via an incorrect permission check in the token creation process. An attacker can gain elevated privileges by crafting requests to the REST API and creatin...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

BIT-PYTHON-2025-4516 Use-after-free in "unicode_escape" decoder with error handler

There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode call in ...

PT-2025-26300 · Unknown · Phpgurukul Directory Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Directory Management System version 1.0 Description: A critical vulnerability was found in the PHPGurukul Directory Management System. The issue affects an unknown functionality of the file /admin/search-directory.php. The...

GHSA-59W6-R9HM-439H XWiki does not require right warnings for XClass definitions

Impact When an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior...

CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881

CVE-2025-48881 pertains to the valtimo-backend-libraries component. Vulnerable versions (11.0.0.RELEASE–11.3.3.RELEASE and 12.0.0.RELEASE–12.12.0.RELEASE) allow unauthorised users to list, view, edit, create or delete objects for which an object-management configuration exists; exposure of object...