1152 matches found
EUVD-2026-69284
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...
EUVD-2026-69086
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155...
EUVD-2026-69076
Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155...
EUVD-2026-69071
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2...
EUVD-2026-68775
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
EUVD-2026-68015
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...
EUVD-2026-66244
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
EUVD-2026-67845
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
EUVD-2026-67842
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...
EUVD-2026-67838
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...
EUVD-2026-67735
Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...
EUVD-2026-67670
None None None No publicly available exploits are known...
EUVD-2026-67667
None None None No publicly available exploits are known...
EUVD-2026-67161
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...
EUVD-2026-66935
Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...
EUVD-2026-65471
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...
EUVD-2026-65166
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
EUVD-2026-64808
Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...