EUVD-2026-60936

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60932

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

EUVD-2026-60931

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

EUVD-2026-60929

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

EUVD-2026-60926

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

EUVD-2026-60915

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

EUVD-2026-60904

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

EUVD-2026-60896

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

EUVD-2026-60761

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...

EUVD-2026-60685

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-60681

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-60664

Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-60749

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-60746

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-60738

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

EUVD-2026-60736

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

EUVD-2026-60733

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...

EUVD-2026-60731

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...

EUVD-2026-60730

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229...

EUVD-2026-60597

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...