EUVD-2024-26046

Malicious code in bioql PyPI...

EUVD-2023-38302

Malicious code in bioql PyPI...

EUVD-2022-36175

Malicious code in bioql PyPI...

EUVD-2022-45418

Malicious code in bioql PyPI...

EUVD-2024-26045

Malicious code in bioql PyPI...

EUVD-2025-20211

Malicious code in bioql PyPI...

EUVD-2023-3168

Malicious code in bioql PyPI...

EUVD-2022-52416

Malicious code in bioql PyPI...

EUVD-2023-1847

Malicious code in bioql PyPI...

EUVD-2022-52068

Malicious code in bioql PyPI...

EUVD-2022-29239

Malicious code in bioql PyPI...

EUVD-2022-43648

Malicious code in bioql PyPI...

EUVD-2025-7664

Malicious code in bioql PyPI...

CVE-2025-10037 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

...

Exploit for CVE-2025-34161

| Field | Value | |-------------|...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-3777 Improper Input Validation in huggingface/transformers

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

CVE-2025-3777

CVE-2025-3777 : In Hugging Face Transformers, versions up to 4.49.0 are affected by improper input validation in image_utils.py due to insecure URL validation with startswith(), bypassable via URL username injection. Attackers could craft URLs that appear to be from YouTube but resolve to malicio...

CVE-2025-49520 Event-driven-ansible: authenticated argument injection in git url in eda project creation

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift...