33408 matches found
EUVD-2026-55884
SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...
EUVD-2026-55878
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...
EUVD-2026-55866
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to...
EUVD-2026-55662
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...
EUVD-2026-55656
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
EUVD-2026-53950
Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...
EUVD-2026-53388
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...
EUVD-2026-51665
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
EUVD-2026-51027
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...
EUVD-2025-210558
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...
EUVD-2026-50083
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...
EUVD-2026-50082
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...
EUVD-2026-49907
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...
EUVD-2026-47897
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...
EUVD-2026-46406
Tanium addressed an information disclosure vulnerability in Connect...
EUVD-2026-46239
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153...
EUVD-2026-46203
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13...
EUVD-2026-45038
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash...
