452077 matches found
EUVD-2026-25222
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections...
EUVD-2026-15806
Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...
EUVD-2026-11645
Poseidon V1 variable-length input collision via implicit zero-padding...
EUVD-2026-9250
In multiple functions of memprotect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-4124
Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which may result in memory corruption and remote code execution...
EUVD-2025-198948
Malicious code in @posthog/event-sequence-timer-plugin npm...
EUVD-2006-1402
Malware in sbrugna...
EUVD-2005-3592
Malware in sbrugna...
EUVD-2018-0172
Malware in sbrugna...
EUVD-2015-9051
Malware in sbrugna...
EUVD-2022-40383
Malicious code in bioql PyPI...
EUVD-2023-52795
Malicious code in bioql PyPI...
EUVD-2025-25793
Malicious code in bioql PyPI...
EUVD-2023-53064
Malicious code in bioql PyPI...
EUVD-2023-41759
Malicious code in bioql PyPI...
EUVD-2026-62344
When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...
EUVD-2026-59280
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...
EUVD-2026-56702
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
EUVD-2026-44878
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...
EUVD-2026-41525
Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure...
EUVD-2026-41407
A stored Cross-Site Scripting XSS vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privilege...
EUVD-2026-41114
Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from before 1.43.9,1.44.6,1.45.4...
EUVD-2026-39822
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer HEADERS with FIN / headers-only close but still carries a nonzero...
EUVD-2026-38043
A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtiosndpcmincb function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730...
EUVD-2026-37646
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Packaged Air Conditioners for Japan and outside Japan; Refrigerators for...
EUVD-2026-36509
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a...
EUVD-2026-31906
A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx of the component Sign-up. The manipulation of the argument redirect leads to cross site scripting. The attack is possible to be carried...
EUVD-2026-30020
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts. The host-claimed bit shared a word with retune flag...
EUVD-2026-29849
Command injection vulnerabilities exist in the command line interface CLI service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying...
EUVD-2026-29443
The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...
EUVD-2026-28671
In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized liclogroundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k...
EUVD-2026-23362
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This...
EUVD-2025-205605
Meshtastic is an open source mesh networking solution. The Meshtastic firmware starting from version 2.5 introduces asymmetric encryption PKI for direct messages, but when the pkiencrypted flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an...
EUVD-2025-204576
DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-67038. Reason: This record is a reservation duplicate of CVE-2025-67038. Notes: All CVE users should reference CVE-2025-67038 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...
EUVD-2025-203538
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded allows Stored XSS.This issue affects User Avatar - Reloaded: from n/a through = 1.2.2...
EUVD-2025-94745
Malicious code in thickalbatrossz3n npm...
EUVD-2025-38105
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through = 1.4...
EUVD-2021-0917
Malware in sbrugna...
EUVD-2020-23275
Malware in sbrugna...
EUVD-2021-19739
Malware in sbrugna...
EUVD-2022-4483
Malicious code in bioql PyPI...
EUVD-2022-3861
Malicious code in bioql PyPI...
EUVD-2024-0260
Malicious code in bioql PyPI...
EUVD-2024-2911
Malicious code in bioql PyPI...
EUVD-2025-25355
Malicious code in bioql PyPI...
EUVD-2022-54099
Malicious code in bioql PyPI...
EUVD-2023-54518
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE...
EUVD-2026-59753
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...