EUVD-2024-0531

Malicious code in bioql PyPI...

EUVD-2024-19784

Malicious code in bioql PyPI...

EUVD-2022-3213

Malicious code in bioql PyPI...

Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their...

Built-in Runtime Security for Containers

Security teams struggle with visibility into behaviors inside their running containers. Qualys is today announcing general availability of Container Runtime Security CRS to provide industry-leading visibility for running containers using an approach that is container-engine agnostic and layered...

BIT-PYTHON-2025-8194 Tarfile infinite loop during parsing with negative member offset

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives...

MINI-P9QJ-FVMG-RJMW

Bulletin has no description...

CVE-2025-8578

Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-8556

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. Mitigation Mitigation for this issue is either not availabl...

CVE-2025-54571

A flaw was found in modsecurity. The engine may allow attackers to manipulate the HTTP response’s Content-Type header, enabling them to influence downstream processes or applications. This manipulation can be achieved remotely without authentication. Consequently, an attacker can alter the expect...

CVE-2025-8341

A flaw was found in github.com/grafana/grafana-infinity-datasource. The Infinity datasource plugin incorrectly handles configuration when restricted to certain data sources, allowing an attacker to potentially trigger an out-of-bounds read. This vulnerability allows a remote attacker to manipulat...

CVE-2025-53399

In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets except when the relay is configured for strict source and learning disabled. Version 13.4.1...

PT-2025-31193 · Unknown · Human Resource Management System

Name of the Vulnerable Software and Affected Versions: Human Resource Management System version 1.0 Description: Reflected Cross-Site Scripting XSS exists in Human Resource Management System version 1.0. This issue could allow an attacker to execute JavaScript code in the victim's browser by...

CVE-2025-8194

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives...

CVE-2025-8197

A global buffer overflow vulnerability was found in the soupheadernametostring function in Libsoup. The soupheadernametostring function does not validate the name parameter passed in, and directly accesses soupheadernamestringsname. The value of name is controllable, when name exceeds the index...

ABB AC500 V2

SUMMARY ABB became aware of vulnerabilities in AC500 V2 listed as affected in the advisory. An attacker who successfully exploited this vulnerability could access fragments of Modbus telegrams that have been sent earlier by that PLC 2. MITIGATING FACTORS Mitigating factors describe conditions...

CVE-2025-53770

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this...

CVE-2025-7783

A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated b...

RHSA-2025:11245 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2025-53027

CVE-2025-53027 affects Oracle VM VirtualBox 7.1.10 (Core). Local attacker with logon can compromise Oracle VM VirtualBox; high impact to confidentiality, integrity and availability (CVSS v3.1 base 8.2). Root cause described as an issue in VirtualBox Core; exploitation details are not provided in ...