468667 matches found
EUVD-2026-17875
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...
EUVD-2026-4331
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File Inclusion.This issue affects EduBlink Core: from n/a through = 2.0.7...
EUVD-2025-197614
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...
EUVD-2021-13806
Malware in sbrugna...
EUVD-2021-0108
Malware in sbrugna...
EUVD-2014-8164
Malware in sbrugna...
EUVD-2021-10036
Malware in sbrugna...
EUVD-2020-4753
Malware in sbrugna...
EUVD-2021-11143
Malware in sbrugna...
EUVD-2020-26234
Malware in sbrugna...
EUVD-2020-12149
Malware in sbrugna...
EUVD-2024-46940
Malicious code in bioql PyPI...
EUVD-2023-54478
Malicious code in bioql PyPI...
EUVD-2023-50532
Malicious code in bioql PyPI...
EUVD-2024-42786
Malicious code in bioql PyPI...
EUVD-2025-25398
Malicious code in bioql PyPI...
EUVD-2025-29456
Malicious code in bioql PyPI...
EUVD-2025-24827
Malicious code in bioql PyPI...
EUVD-2022-39291
Malicious code in bioql PyPI...
EUVD-2025-29700
Malicious code in bioql PyPI...
EUVD-2022-6864
Malicious code in bioql PyPI...
EUVD-2024-54518
Malicious code in bioql PyPI...
EUVD-2024-2493
Malicious code in bioql PyPI...
EUVD-2026-73260
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network...
EUVD-2026-37012
gRPC Erlang package has unbounded request body accumulation in readfullbody/3...
EUVD-2026-59901
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-58789
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
EUVD-2026-58190
Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...
EUVD-2026-56880
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
EUVD-2026-56395
Use after free in Active Directory Certificate Services AD CS allows an authorized attacker to execute code over a network...
EUVD-2026-55239
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
EUVD-2026-52671
Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...
EUVD-2026-52478
An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...
EUVD-2026-44927
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator...
EUVD-2026-47625
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data...
EUVD-2026-47415
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this...
EUVD-2026-45293
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized...
EUVD-2026-43259
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the argument httpOID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...
EUVD-2026-42544
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an...
EUVD-2026-42488
Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
EUVD-2026-41889
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to acces...
EUVD-2025-210370
Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges...
EUVD-2026-39777
Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...
EUVD-2026-39230
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
EUVD-2026-39219
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrackirc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given...
EUVD-2026-38551
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting XSS vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The contin...
EUVD-2026-36933
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...
EUVD-2026-35549
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability...
EUVD-2026-36609
OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...
EUVD-2026-36414
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections...