33905 matches found
EUVD-2026-67838
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...
EUVD-2026-67735
Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...
EUVD-2026-67731
Contributor Broken Access Control in WpEvently = 5.5.0 versions...
EUVD-2026-67730
Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...
EUVD-2026-67727
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
EUVD-2026-67670
None None None No publicly available exploits are known...
EUVD-2026-67667
None None None No publicly available exploits are known...
EUVD-2026-67664
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...
EUVD-2026-67179
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...
EUVD-2026-67161
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...
EUVD-2026-67240
EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."...
EUVD-2026-67239
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
EUVD-2026-66952
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
EUVD-2026-66945
Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...
EUVD-2026-66941
Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...
EUVD-2026-66935
Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...
EUVD-2026-66988
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...
EUVD-2026-66597
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...
EUVD-2026-66341
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...