33452 matches found
EUVD-2026-68790
Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...
EUVD-2026-68788
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
EUVD-2026-68786
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
EUVD-2026-68782
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...
EUVD-2026-68780
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
EUVD-2026-68777
Subscriber SQL Injection in Charitable = 1.8.12.1 versions...
EUVD-2026-68775
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
EUVD-2026-68313
A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should...
EUVD-2026-68234
WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...
EUVD-2026-68015
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...
EUVD-2026-67868
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
EUVD-2026-66244
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
EUVD-2026-67857
WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...
EUVD-2026-67845
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
EUVD-2026-67842
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...
EUVD-2026-67838
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...
EUVD-2026-67735
Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...
EUVD-2026-67731
Contributor Broken Access Control in WpEvently = 5.5.0 versions...