EUVD-2026-63680

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...

EUVD-2026-63546

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

EUVD-2026-63460

Adminer multiquery Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

EUVD-2026-63458

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

EUVD-2026-63457

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

EUVD-2026-63438

OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must...

EUVD-2026-63325

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

EUVD-2025-210752

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

EUVD-2025-210751

HCL IntelliOps Event Management IEM is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response...

EUVD-2026-63317

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

EUVD-2026-63303

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

EUVD-2026-63302

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

EUVD-2026-63340

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

EUVD-2026-63333

Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-63329

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

EUVD-2025-210757

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

EUVD-2025-210755

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

EUVD-2025-210756

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

EUVD-2026-63328

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

EUVD-2026-63255

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...