EUVD-2026-57257

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

EUVD-2026-57256

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

EUVD-2026-57255

A low-privileged authenticated user may access restricted support information under specific conditions...

EUVD-2026-57254

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...

EUVD-2026-57253

A user with access to a valid SAML response may impersonate another user under specific conditions...

EUVD-2026-57250

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

EUVD-2026-57249

An unauthenticated user may bypass authentication under specific cache conditions...

EUVD-2026-57247

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

EUVD-2026-57246

An unauthenticated user may access restricted repository information under specific conditions...

EUVD-2026-57245

A bundle writer may create misleading release promotion information under specific conditions...

EUVD-2026-57244

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

EUVD-2026-57243

A repository publisher without delete permission may modify protected package content under specific conditions...

EUVD-2026-57241

Credentials for a deleted user may remain valid for a short period under specific conditions...

EUVD-2026-57240

A Project Resource Manager may gain broader administrative privileges under specific conditions...

EUVD-2026-57238

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability...

EUVD-2026-57224

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

EUVD-2026-57212

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...

EUVD-2026-57194

A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker ...

EUVD-2026-57190

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

EUVD-2025-210707

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...