EUVD-2025-210236

Unauthenticated Local File Inclusion in Tipsy = 1.1 versions...

EUVD-2025-210234

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

EUVD-2025-210233

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

EUVD-2026-37732

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

CVE-2026-49502

Dell PowerFlex Manager, versions prior to 5.1.0.1, contains an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access...

CVE-2026-54816

Improper Control of Generation of Code 'Code Injection' vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21...

CVE-2026-54809

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10...

CVE-2026-40733

Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...

CVE-2026-39556

Unauthenticated PHP Object Injection in Konsept = 1.9 versions...

CVE-2025-69166

Unauthenticated Local File Inclusion in Gunslinger = 1.7 versions...

CVE-2025-69174

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2025-69170

Unauthenticated Local File Inclusion in Eventicity = 1.5 versions...

CVE-2025-69164

Unauthenticated Local File Inclusion in Skyward = 1.10 versions...

CVE-2025-69157

Unauthenticated Local File Inclusion in Gamic = 1.15 versions...

CVE-2025-69127

Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...

CVE-2025-69120

Unauthenticated Local File Inclusion in Dazzle = 1.0.0 versions...

CVE-2025-66391

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account...

CVE-2026-54196

Subscriber Privilege Escalation in JetFormBuilder = 3.6.1 versions...

CVE-2026-48869

Unauthenticated Cross Site Scripting XSS in Enfold = 7.1.4 versions...

CVE-2026-40754

Unauthenticated PHP Object Injection in Roisin = 1.4 versions...