EUVD-2026-0045

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

EUVD-2026-0042

An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request...

EUVD-2026-0696

REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts...

EUVD-2026-0038

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

EUVD-2026-0661

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/drivernmea2000.c file. The hnd129540 function, which handles NMEA2000 PGN 129540 GNSS Satellites in View packets, fails to validate the user-supplied satellite count against the size of the skyview...

EUVD-2026-0001

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user when knowing their email address when such user does not have an account on disqus.com yet...

PT-2026-6156

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel's virtio transports are susceptible to an issue where the transmission TX credit is derived directly from peer buf alloc, which is determined by the remote endpoint's SO...

PT-2026-21703

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Firefox ESR versions prior to 115.33 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 Description A use-after-free issue exists in the DOM: Bindings WebIDL...

PT-2026-21708

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Firefox ESR versions prior to 115.33 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 Description A mitigation bypass exists in the DOM: HTML Parser...

ASB-A-438955204

In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-28179

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.9.2 Description pypdf is a free and open-source pure-python PDF library. A crafted PDF file can cause an infinite loop when read in non-strict mode. This issue requires reading a file in non-strict mode. Applying the...

PT-2026-25631

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.7.5 Description The software contains a flaw where parsing DTD content can lead to an infinite loop. Recommendations Update libexpat to version 2.7.5 or later...

PT-2026-21332

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.0.8-5 Description A heap-buffer-overflow exists when processing specially crafted PSD Photoshop Document files. The issue occurs within the fread pascal string function because the buffer allocated for a Pascal string ...

PT-2026-21720

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Firefox ESR versions prior to 115.33 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 Description A use-after-free issue exists in the DOM, specifically...

PT-2026-25791

Name of the Vulnerable Software and Affected Versions Expat affected versions not specified Description The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. Thi...

EUVD-2025-205992

A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php of the component Search API Endpoint. Executing manipulation of the argument keyword can lead to sql injection. It is possible to launch th...

CVE-2025-62119

CVE-2025-62119 corresponds to the WordPress plugin Add Featured Image Custom Link. According to the connected Wordfence report, it is an Authenticated (Author+) Stored DOM-based XSS vulnerability affecting Add Featured Image Custom Link versions ≤ 2.0.0. The report lists the CVE with the issue ty...

CVE-2025-62756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lvaudore The Moneytizer the-moneytizer allows DOM-Based XSS.This issue affects The Moneytizer: from n/a through = 10.0.9...

CVE-2025-62748 WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery Builder vc-addons-by-bit14 allows DOM-Based XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through = 1.5...

CVE-2025-69033

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through = 1.7.3...