EUVD-2026-1217

EUVD-2026-1217...

EUVD-2026-1254

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in JanStudio Gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through 1.9.8...

EUVD-2026-1338

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated...

EUVD-2026-0985

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through = 3.0.3...

EUVD-2026-1008

A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could ...

EUVD-2026-0784

EUVD-2026-0784...

EUVD-2026-0078

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0189

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0217

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0222

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0284

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0321

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0346

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

EUVD-2026-0598

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

Happy 16th Birthday, KrebsOnSecurity.com!

KrebsOnSecurity.com celebrates its 16th anniversary today! A huge "thank you" to all of our readers -- newcomers, long-timers and drive-by critics alike. Your engagement this past year here has been tremendous and truly a salve on a handful of dark days. Happily, comeuppance was a strong theme...

EUVD-2025-205318

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser...

CVE-2023-53935

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed request...

EUVD-2025-204350

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed request...

EUVD-2025-204376

A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /userleads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been...

CVE-2023-53935

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed request...