EUVD-2026-95812

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication...

EUVD-2026-95811

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system...

EUVD-2026-95805

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP...

EUVD-2026-95803

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

EUVD-2026-95491

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

EUVD-2026-95422

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

EUVD-2026-95416

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...

EUVD-2026-95423

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

EUVD-2026-94853

heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...

EUVD-2026-94824

An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation...

EUVD-2026-94067

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...

EUVD-2026-93961

A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...

EUVD-2026-93960

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

EUVD-2026-93959

Improper neutralization of Lightweight Directory Access Protocol LDAP authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service...

EUVD-2026-93950

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository...

EUVD-2026-93947

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process...

EUVD-2026-93945

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

EUVD-2026-93914

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

EUVD-2026-93789

In platformmsghandlerinit of defaultmsghandlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-93489

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset...