33904 matches found
EUVD-2026-85480
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
EUVD-2026-85478
Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...
EUVD-2026-85474
Administrator SQL Injection in Email Log = 2.63 versions...
EUVD-2026-85471
Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...
EUVD-2026-85463
Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...
EUVD-2026-85524
JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...
EUVD-2026-85219
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...
EUVD-2026-84792
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...
EUVD-2026-84785
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...
EUVD-2026-84555
An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...
EUVD-2026-84547
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...
EUVD-2026-83432
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation...
EUVD-2026-83199
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...
EUVD-2026-83131
IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...
EUVD-2026-82863
A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...
EUVD-2026-82655
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...
EUVD-2026-82586
Azure Arc Elevation of Privilege Vulnerability...
EUVD-2026-81518
Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...