9219 matches found
EUVD-2026-2872
SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by embedding malicious JavaScript that triggers remote command execution through file or title inputs...
EUVD-2026-2896
Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload markdown files with embedded JavaScript payloads to execute remote commands and potentially gain system access...
EUVD-2026-2906
Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into category titles. Attackers can create a new contact category with a script payload that will execute when the page is viewed by other users...
EUVD-2026-2902
Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands...
EUVD-2026-2885
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...
EUVD-2026-2897
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps...
CVE-2025-15104
creationtimestamp| type| source ---|---|--- 2026-01-16 15:50:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mckh7tsxnt2y 2026-01-24 21:23:52+00:00| seen| https://gist.github.com/alon710/0c9e36c925f1bdd7c2d8d9f8354d1359 2026-01-24 22:27:48+00:00| seen|...
EUVD-2026-2944
TheLibrarians webfetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixed the vulnerability in all affected versions...
CVE-2025-12007
creationtimestamp| type| source ---|---|--- 2026-01-16 11:31:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcjyrqhzui22...
EUVD-2026-2950
HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...
EUVD-2026-2959
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eaelproductquickviewpopup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for...
CVE-2026-1000
creationtimestamp| type| source ---|---|--- 2026-01-16 07:51:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcjmig53qb2c 2026-01-16 10:21:33+00:00| seen| https://gist.github.com/Darkcrai86/b197f1b13ce3a5aecff6d620f82dd6fb...
EUVD-2026-2957
The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possible for authenticated attackers, with Author-level access a...
EUVD-2026-2964
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-2972
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration function. This makes it possible for authenticated attackers, wi...
EUVD-2026-2982
The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible...
CVE-2026-23712
Not used...
CVE-2021-47803
creationtimestamp| type| source ---|---|--- 2026-01-16 01:33:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcixdqlqfj2q...