EUVD-2026-0049

A vulnerability was detected in code-projects Content Management System 1.0. The affected element is an unknown function of the file /pages.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used...

EUVD-2026-0046

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve share tokens intended for unrelated access via a sharedservers endpoint...

EUVD-2026-0039

In Plex Media Server PMS through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account...

EUVD-2026-0037

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-21445

creationtimestamp| type| source ---|---|--- 2026-01-02 16:18:24+00:00| published-proof-of-concept| https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx 2026-01-03 14:32:26+00:00| seen| Telegram/hVIsWvvgLiiMGtF82joYNFY3TrnJxWWlKsVG9afGpT3z9w 2026-01-04 09:00:05+00:00|...

EUVD-2026-0672

An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to bypass protection mechanism. We have already fixed the vulnerability in the following version: Malware Remover 6.6.8.20251023 and later...

EUVD-2026-0660

An SQL injection vulnerability has been reported to affect MARS Multi-Application Recovery Service. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS Multi-Application Recovery...

EUVD-2026-0667

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...

EUVD-2026-0671

An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: License Center 2.0.36 and later...

EUVD-2026-0674

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS...

EUVD-2026-0687

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions:...

EUVD-2026-0681

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

EUVD-2026-0685

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS...

EUVD-2026-0693

An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same...

EUVD-2026-0695

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following...

EUVD-2026-0694

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The...

CVE-2026-0547

creationtimestamp| type| source ---|---|--- 2026-01-02 12:34:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbgvqlpla62c 2026-01-02 13:41:25+00:00| published-proof-of-concept| Telegram/hpVaRRNfP1jvaZsEgfRxDrvpBKNl3zmTFxWvmFJDbw9ttU...

EUVD-2026-0704

A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/workedit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may b...

CVE-2025-15424

creationtimestamp| type| source ---|---|--- 2026-01-02 04:33:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbg2vkqh3y2r 2026-01-02 18:53:53+00:00| published-proof-of-concept| Telegram/06q-TvAKXAyL-ZabO-7p63z6qQH9ntO7cFX9ghbvmNNE5E 2026-01-02 21:55:41+00:00|...

EUVD-2026-0707

A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might...