CVE-2026-5599 API allows deletion of users of other instance

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds...

venueless 安全漏洞

Venueless is an open-source online activity platform developed by Venueless. There are security vulnerabilities in Venueless, stemming from improper permission management. These vulnerabilities could allow users with API access and the “Manage Users” permission to delete user accounts from other...

CVE-2026-4982

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channe...

CVE-2026-4982 Unauthorized access to chat contents

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channe...

EUVD-2026-16593

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channe...

venueless 安全漏洞

Venueless is an open-source online activity platform developed by Venueless. There are security vulnerabilities in Venueless; these vulnerabilities stem from defects in the reporting feature, which may allow users with update world permissions to disclose chat messages from other worlds on the sa...

Friday Squid Blogging: Giant Squid in the Star Trek Universe

Spock befriends a giant space squid in the comic Star Trek: Strange New Worlds: The Seeds of Salvation 5. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

CVE-2020-24199

Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution...

EUVD-2020-3895

Malware in sbrugna...

EUVD-2020-21584

Malware in sbrugna...

EUVD-2020-3896

Malware in sbrugna...

EUVD-2020-18636

Malware in sbrugna...

EUVD-2020-16934

Malware in sbrugna...

EUVD-2024-33627

Malicious code in bioql PyPI...

EUVD-2025-9064

Malicious code in bioql PyPI...

EUVD-2025-7329

Malicious code in bioql PyPI...

EUVD-2024-16442

Malicious code in bioql PyPI...

EUVD-2025-14070

Malicious code in bioql PyPI...

EUVD-2025-15077

Malicious code in bioql PyPI...

EUVD-2025-7327

Malicious code in bioql PyPI...