EUVD-2021-9792

Malicious code in bioql PyPI...

EUVD-2023-34923

Malicious code in bioql PyPI...

EUVD-2022-34899

Malicious code in bioql PyPI...

EUVD-2025-21553

Malicious code in bioql PyPI...

CVE-2025-61593

Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files i.e. /.cursor/cli.json allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A...

EUVD-2025-32310

Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files i.e. /.cursor/cli.json allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A...

CVE-2025-61593

CVE-2025-61593 affects Cursor, specifically Cursor CLI Agent in Cursor editor versions ≤ 1.7. The vulnerability stems from inadequate protection of sensitive files (e.g., /.cursor/cli.json ), allowing an attacker to inject prompts that modify these files, which can lead to remote code execution. ...

CVE-2025-61593 Cursor CLI Agent: Sensitive File Overwrite Bypass

Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files i.e. /.cursor/cli.json allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A...

PT-2025-40600

Name of the Vulnerable Software and Affected Versions Cursor versions 1.6.23 and below Description Cursor IDE has case-sensitive checks when protecting sensitive files, such as /.cursor/mcp.json. This allows attackers to modify these files through prompt injection, potentially leading to remote...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the validLogFileName and validExecOutputFileName functions, which insufficiently validate log file names, allowing traversal sequences after certain prefixes. An attacker can access sensitive files on the host...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the validLogFileName and validExecOutputFileName functions, which insufficiently validate log file names, allowing traversal sequences after certain prefixes. An attacker can access sensitive files on the host...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the validLogFileName and validExecOutputFileName functions, which insufficiently validate log file names, allowing traversal sequences after certain prefixes. An attacker can access sensitive files on the host...

Directory Traversal

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Directory Traversal via the ComboServlet component. An attacker can access arbitrary CSS and JS files and cause repeated loading of these files by manipulating the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the streamhandler function in the file handler component when manipulating the key argument. An unauthenticated user can access sensitive information by sending specially crafted requests remotely. Details A...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the loghandler function. An unauthenticated user can access or modify files outside the intended directory by supplying crafted input to the file argument. Details A Directory Traversal attack also known as path...

CVE-2025-9081 IDOR in board file download allows any user to download any file by UUID

Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...

PT-2025-38620

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Description Mattermost fails to properly validate access controls, allowing any authenticated user to download sensitive files. This is possible through the...

External Control of File Name or Path

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to External Control of File Name or Path via the GET /api/v1/images/download/bulkdownloaditemname...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal due to improper validation of user-supplied paths in router.go. An attacker can access sensitive files on the server by crafting requests with directory traversal sequences in the URL path. Remediation A fix was...

GHSA-49PV-GWXP-532R esm.sh has File Inclusion issue

Summary A Local File Inclusion LFI issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other unintended file sources. Severity: High — LFI can expose secrets, configuration files,...