Kirby CMS's system API endpoint leaks installed version and license data to authenticated users

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can...

EUVD-2026-11478

A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function server.tool of the file index.js of the component Tshark CLI Command Handler. The manipulation results in os command injection. The attack needs to be approached locally. The explo...

CVE-2026-3813

opencc JFlow contains a vulnerability CVE-2026-3813 affecting the function Calculate in src/main/java/bp/wf/httphandler/WF_CCForm.java. The issue enables injection and can be triggered remotely; an exploit is publicly available. The project uses a rolling release model and does not disclose affec...

CVE-2026-22645

CVE-2026-22645 is linked to SICK’s product stack, with related documentation noting vulnerabilities in Grafana that affect only the administrative log-management UI and not the Incoming Goods Suite UI. The public descriptions identify that the application discloses components, versions, and licen...

EUVD-2026-2804

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...

CVE-2025-66205

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2...

CVE-2025-66205

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2...

CVE-2025-61959

The CVE-2025-61959 entry concerns Vertikal Systems’ Hospital Manager Backend Services. Connected sources confirm concrete details: prior to 19 Sep 2025, the product exposed a live ASP.NET tracing endpoint (/trace.axd) without authentication, enabling remote attackers to harvest request metadata, ...

CVE-2025-62524

PILOS (Frontend for BigBlueButton) before version 4.8.0 disclosed PHP version information via the X-Powered-By header, enabling server fingerprinting. The vulnerability originates from the base PHP image and can also be inferred from the PILOS footer or GitHub source. It has been patched in PILOS...

EUVD-2021-25391

Malware in sbrugna...

EUVD-2021-25393

Malware in sbrugna...

EUVD-2006-5015

Malware in sbrugna...

EUVD-2010-2991

Malware in sbrugna...

EUVD-2024-50125

Malicious code in bioql PyPI...

EUVD-2024-50047

Malicious code in bioql PyPI...

EUVD-2023-58114

Malicious code in bioql PyPI...

EUVD-2022-3974

Malicious code in bioql PyPI...

EUVD-2023-29496

Malicious code in bioql PyPI...

EUVD-2025-27088

Malicious code in bioql PyPI...

EUVD-2025-14353

Malicious code in bioql PyPI...