EUVD-2026-58142

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

EUVD-2026-58140

Email Management API Bypasses ManageCredentials Feature Restrictions...

EUVD-2026-58139

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

EUVD-2026-58138

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

EUVD-2026-58136

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

EUVD-2026-58137

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

EUVD-2026-58134

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

EUVD-2026-58034

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

EUVD-2026-58094

rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns a...

EUVD-2026-57917

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

EUVD-2026-57913

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...

EUVD-2026-57911

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

EUVD-2026-57908

Unauthenticated Sensitive Data Exposure in KiviCare = 4.5.1 versions...

EUVD-2026-57901

Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...

EUVD-2026-57902

Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...

EUVD-2026-57897

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

EUVD-2026-57895

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

EUVD-2026-57890

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

EUVD-2026-57889

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

EUVD-2026-57876

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...