433104 matches found
EUVD-2020-7270
Malware in sbrugna...
EUVD-2026-19763
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via /.cassandra/cqlshhistory local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description:...
EUVD-2026-44024
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network...
EUVD-2026-35723
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
EUVD-2025-26961
Malicious code in bioql PyPI...
EUVD-2026-11519
A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function jsiteratorconcatreturn of the file quickjs.c. This manipulation causes use after free. The attack requires local access. The exploit has been published and may be used. Patch name:...
EUVD-2022-51645
Malicious code in bioql PyPI...
EUVD-2026-49331
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...
EUVD-2026-45899
A vulnerability was found in the network packet de-fragmentation engine of kronosnet Version affected = 1.34. The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets...
EUVD-2022-29573
Malicious code in bioql PyPI...
EUVD-2024-49112
Malicious code in bioql PyPI...
EUVD-2026-50218
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...
EUVD-2019-11516
Malware in sbrugna...
EUVD-2026-36269
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...
EUVD-2017-18736
Malware in sbrugna...
EUVD-2020-1620
Malware in sbrugna...
EUVD-2026-35548
Improper link resolution before file access 'link following' in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally...
EUVD-2026-36603
An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized to use or view. When editing objects, the sharing group...
EUVD-2024-34509
Malicious code in bioql PyPI...
EUVD-2026-45084
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...
EUVD-2026-29658
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally...
EUVD-2025-9230
Malicious code in bioql PyPI...
EUVD-2025-22233
Malicious code in bioql PyPI...
EUVD-2023-0869
Malicious code in bioql PyPI...
EUVD-2026-36367
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly...
EUVD-2026-20896
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldapescape. An unauthenticated attacker can inject LDAP filter metacharacters into the username field ...
EUVD-2026-29955
Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options...
EUVD-2026-8451
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox 148...
EUVD-2004-1713
Malware in sbrugna...
EUVD-2026-27798
In the Linux kernel, the following vulnerability has been resolved: media: iris: Add missing platform data entries for SM8750 Two platform-data fields for SM8750 were missed: - getvpubuffersize = irisvpu33bufsize Without this, the driver fails to allocate the required internal buffers, leading to...
EUVD-2026-41085
Improper Input Validation CWE-20 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality...
EUVD-2025-179597
Malicious code in configstore-jabbah-koa-public npm...
EUVD-2017-3307
Malware in sbrugna...
EUVD-2021-21077
Malware in sbrugna...
EUVD-2024-46922
Malicious code in bioql PyPI...
EUVD-2026-35707
Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...
EUVD-2026-25450
In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmetctrlfree flushes ctrl-asynceventwork. If nvmetctrlfree runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:- A. Async event work queued on...
EUVD-2024-19502
Malicious code in bioql PyPI...
EUVD-2026-35303
The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-27213
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the LiveAction::reset function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post...
EUVD-2018-1183
Malware in sbrugna...
EUVD-2023-23611
Malicious code in bioql PyPI...
EUVD-2025-23495
Malicious code in bioql PyPI...
EUVD-2026-57192
A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via...
EUVD-2026-35527
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
EUVD-2026-29623
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
EUVD-2026-3933
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local File Inclusion.This issue affects Indoor Plants: from n/a through = 1.2.7...
EUVD-2018-4327
Malware in sbrugna...