EUVD-2023-38462

Malicious code in bioql PyPI...

EUVD-2025-7571

Malicious code in bioql PyPI...

EUVD-2024-44589

Malicious code in bioql PyPI...

EUVD-2023-32494

Malicious code in bioql PyPI...

EUVD-2023-36476

Malicious code in bioql PyPI...

EUVD-2023-29724

Malicious code in bioql PyPI...

EUVD-2025-27377

Malicious code in bioql PyPI...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate 5.13.2 and earlier versions, which stems from the presence of an open redirect in the redir parameter that could result in a redirect to an attacker-controlled site...

CVE-2025-57872

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

CVE-2025-57872

The CVE-2025-57872 entry concerns Esri Portal for ArcGIS 11.4 and earlier, which contains an unvalidated redirect vulnerability. An unauthenticated remote attacker could craft a URL that redirects victims to an attacker‑controlled site, potentially enabling phishing. Public details across sources...

CVE-2025-57879 BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

PT-2025-39865

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description An unvalidated redirect issue exists in Esri Portal for ArcGIS. A remote, unauthenticated attacker can create a malicious URL that redirects a user to an arbitrary website, potentially...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via improper handling of caches. An attacker can obtain unauthorized access to sensor information by tricking a user into visiting a malicious website. This is only exploitable if the system is configured with certain...

WordPress plugin WP Gravity Forms Keap/Infusionsoft 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An input...

CVE-2025-43356

A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches. Mitigation Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the...

Ongoing FileFix Attack Installs StealC Infostealer Via Fake Facebook Pages

Researchers spot FileFix phishing sites that deliver StealC Infostealer through fake Facebook warnings and hidden payloads in images...

CVE-2025-43327

The issue was addressed by adding additional logic. This issue is fixed in Safari 26. Visiting a malicious website may lead to address bar spoofing...

Mattermost Open Redirect vulnerability

Mattermost versions 10.5.x = 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs...

CVE-2025-9084 Open redirect in OAuth login

Mattermost versions 10.5.x = 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs...

CVE-2025-10193 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...