452110 matches found
EUVD-2026-29950
Bandit: Unauthenticated one-shot DoS via Transfer-Encoding: chunked...
EUVD-2026-29456
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through = 1.5.1...
EUVD-2021-34807
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the...
EUVD-2021-34800
Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in...
EUVD-2026-28453
Improper neutralization of special elements used in a command 'command injection' in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-28422
The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp". An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink...
EUVD-2026-28348
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal...
EUVD-2026-28312
YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data'idfiche' value sourced from $POST'idfiche' is concatenated directly into a raw SQL query without any...
EUVD-2026-27382
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. django.middleware.cache.UpdateCacheMiddleware erroneously caches requests where the Vary header contained an asterisk ''. This can lead to private data being stored and served. Earlier, unsupported Django series such as 5.0.x,...
EUVD-2026-26296
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting sendfile type to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the...
EUVD-2026-25930
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...
EUVD-2026-22993
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution...
EUVD-2026-18925
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validatetoken returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access t...
EUVD-2025-209103
Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR...
EUVD-2026-4331
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File Inclusion.This issue affects EduBlink Core: from n/a through = 2.0.7...
EUVD-2026-4408
The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lwcontentblock' shortcode in all versions up to, and including, 3.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
EUVD-2026-2183
Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally...
EUVD-2025-180513
Malicious code in acamar-prettier-stylelint-run-script-hapi npm...
EUVD-2025-114227
Malicious code in elara-mini-css-extract-plugin-lynx-grus npm...
EUVD-2025-37898
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires...
EUVD-2020-14257
Malware in sbrugna...
EUVD-2021-20812
Malware in sbrugna...
EUVD-2019-18289
Malware in sbrugna...
EUVD-2007-0051
Malware in sbrugna...
EUVD-2021-10036
Malware in sbrugna...
EUVD-2021-21279
Malware in sbrugna...
EUVD-2025-16622
Malicious code in bioql PyPI...
EUVD-2025-9086
Malicious code in bioql PyPI...
EUVD-2023-54361
Malicious code in bioql PyPI...
EUVD-2024-54518
Malicious code in bioql PyPI...
EUVD-2023-33852
Malicious code in bioql PyPI...
EUVD-2022-35061
Malicious code in bioql PyPI...
EUVD-2025-12150
Malicious code in bioql PyPI...
EUVD-2025-31157
Malicious code in bioql PyPI...
EUVD-2023-58939
Malicious code in bioql PyPI...
EUVD-2024-34521
Malicious code in bioql PyPI...
EUVD-2022-26465
Malicious code in bioql PyPI...
EUVD-2022-39291
Malicious code in bioql PyPI...
EUVD-2024-3551
Malicious code in bioql PyPI...
EUVD-2021-30152
Malicious code in bioql PyPI...
EUVD-2026-64272
Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...
EUVD-2026-59661
In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...
EUVD-2026-58548
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
EUVD-2026-57352
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...
EUVD-2026-53371
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...
EUVD-2026-48721
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...
EUVD-2026-46144
The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...
EUVD-2026-44094
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally...
EUVD-2026-34013
Tesla vulnerable to atom exhaustion via untrusted URL scheme...
EUVD-2026-41762
Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation. This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4...