33838 matches found
EUVD-2026-90077
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...
EUVD-2026-89843
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
EUVD-2026-89729
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...
EUVD-2026-89467
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...
EUVD-2026-89475
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...
EUVD-2026-89468
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...
EUVD-2026-89474
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...
EUVD-2026-89460
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...
EUVD-2026-89193
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...
EUVD-2026-89191
Out-of-bounds Read from Unvalidated MSRP Attribute List Length...
EUVD-2026-89190
NULL Pointer Dereference When Evicting the Sole MSRP Attribute...
EUVD-2026-89189
NULL Pointer Dereference on MSRP Attribute Table Exhaustion...
EUVD-2026-89177
nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...
EUVD-2026-88972
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...
EUVD-2026-88752
Malicious HTML content could be injected into the help texts of various fields with organizer permissions...
EUVD-2026-88751
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...
EUVD-2026-88750
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...
EUVD-2026-88748
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...