33904 matches found
EUVD-2026-87321
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...
EUVD-2026-86470
A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...
EUVD-2026-86410
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...
EUVD-2026-85857
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...
EUVD-2026-85810
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability...
EUVD-2026-86268
zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump...
EUVD-2026-85620
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...
EUVD-2026-85617
A vulnerability was determined in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be...
EUVD-2026-85542
RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...
EUVD-2026-85540
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
EUVD-2026-85536
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
EUVD-2026-85534
/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...
EUVD-2026-85506
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
EUVD-2026-85496
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
EUVD-2026-85494
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
EUVD-2026-85490
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
EUVD-2026-85487
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
EUVD-2026-85486
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...