EUVD-2026-69083

Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155...

EUVD-2026-69082

Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

EUVD-2026-69077

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

EUVD-2026-69076

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155...

EUVD-2026-69071

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

EUVD-2026-68790

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

EUVD-2026-68788

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

EUVD-2026-68786

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

EUVD-2026-68782

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68780

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

EUVD-2026-68777

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

EUVD-2026-68775

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

EUVD-2026-68313

A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should...

EUVD-2026-68234

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

EUVD-2026-67868

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

EUVD-2026-66244

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...

EUVD-2026-67857

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

EUVD-2026-67845

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

EUVD-2026-67842

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...