EUVD-2026-57950

Subscriber Path Traversal in Do Lasso = 358 versions...

EUVD-2026-57949

Subscriber SQL Injection in Do Lasso = 358 versions...

EUVD-2026-57944

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

EUVD-2026-57934

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

EUVD-2026-57848

Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

EUVD-2026-57846

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

EUVD-2026-57847

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

EUVD-2026-57843

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57774

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control...

EUVD-2026-57773

CWE-306: Missing Authentication for Critical Function...

EUVD-2026-57772

CWE-284: Improper Access Control...

EUVD-2026-57771

CWE-602: Client-Side Enforcement of Server-Side Security...

EUVD-2026-57770

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

EUVD-2026-57769

CWE-203: Observable Discrepancy...

EUVD-2026-57768

CWE-284: Improper Access Control...

EUVD-2026-57761

CWE-287: Improper Authentication...

EUVD-2026-57760

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

EUVD-2026-57693

The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...

EUVD-2026-57632

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

EUVD-2026-57634

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...