EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67670

None None None No publicly available exploits are known...

EUVD-2026-67667

None None None No publicly available exploits are known...

EUVD-2026-67664

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

EUVD-2026-67179

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

EUVD-2026-66952

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

EUVD-2026-66945

Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66935

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

EUVD-2026-66988

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

EUVD-2026-66597

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...

EUVD-2026-66341

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

EUVD-2025-210783

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2026-65627

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

EUVD-2026-65471

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...

EUVD-2026-65166

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

EUVD-2026-64948

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities...