452196 matches found
EUVD-2026-28805
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a...
EUVD-2026-28762
In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bondsetupbyslave kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI RIP: 0010:pskbexpandhead+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS:...
EUVD-2026-28387
Weblate Vulnerable to Private Translation Enumeration via Screenshot API...
EUVD-2026-27067
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler httpserver/updown.go lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: on the OPTIONS...
EUVD-2026-22154
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of th...
EUVD-2026-22079
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery SSRF vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation e.g.,...
EUVD-2026-14535
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly...
EUVD-2026-8894
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export endpoint by exploiting an overly permissive allowlist in canexportentity?. The method allowed moderators to export any entity not explicit...
EUVD-2025-198258
A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub2.1.0.1567x64rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. Th...
EUVD-2021-11143
Malware in sbrugna...
EUVD-2008-5420
Malware in sbrugna...
EUVD-2020-0848
Malware in sbrugna...
EUVD-2020-17931
Malware in sbrugna...
EUVD-2020-12149
Malware in sbrugna...
EUVD-2020-5759
Malware in sbrugna...
EUVD-2023-45841
Malicious code in bioql PyPI...
EUVD-2025-25404
Malicious code in bioql PyPI...
EUVD-2023-23542
Malicious code in bioql PyPI...
EUVD-2023-44605
Malicious code in bioql PyPI...
EUVD-2025-17026
Malicious code in bioql PyPI...
EUVD-2024-53507
Malicious code in bioql PyPI...
EUVD-2024-27167
Malicious code in bioql PyPI...
EUVD-2023-35115
Malicious code in bioql PyPI...
EUVD-2024-1857
Malicious code in bioql PyPI...
EUVD-2025-9242
Malicious code in bioql PyPI...
EUVD-2025-17021
Malicious code in bioql PyPI...
EUVD-2023-50532
Malicious code in bioql PyPI...
EUVD-2023-12509
Malicious code in bioql PyPI...
EUVD-2022-35082
Malicious code in bioql PyPI...
EUVD-2024-36696
Malicious code in bioql PyPI...
EUVD-2022-3656
Malicious code in bioql PyPI...
EUVD-2025-25398
Malicious code in bioql PyPI...
EUVD-2025-12492
Malicious code in bioql PyPI...
EUVD-2026-70285
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...
EUVD-2026-67314
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control...
EUVD-2026-60508
This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...
EUVD-2026-59289
In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...
EUVD-2026-58789
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
EUVD-2026-56673
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally...
EUVD-2026-56369
Integer underflow wrap or wraparound in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network...
EUVD-2026-44818
Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts parse the node.js mirror's index.tab and use each release's LTS...
EUVD-2026-44649
The Grav API plugin getgrav/grav-plugin-api before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti JWT ID claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime...
EUVD-2026-43388
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through = 2.5...
EUVD-2026-42243
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Integer overflow or wraparound vulnerability. An unauthenticated attacker...
EUVD-2026-42039
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...
EUVD-2026-41452
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947. This issue affects Fireware OS 12.0 up to and...
EUVD-2026-40421
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it...
EUVD-2026-38886
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid reading already updated pages during GC We found the following issue during fuzz testing: page: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9 memcg:f8ffff800e269c00 aops:f2fsmetaaops ino:2...
EUVD-2026-37607
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
EUVD-2026-36669
A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment...