468687 matches found
EUVD-2026-26902
mutt before 2.3.2 has an infinite loop in dataobjecttostream in crypt-gpgme.c...
EUVD-2026-24461
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...
EUVD-2026-23498
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings e.g., enabling SSH, allowing unauthorized state changes that can facilitate later compromise...
EUVD-2026-22154
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of th...
EUVD-2026-21047
Beszel has an IDOR in hub API endpoints that read system ID from URL parameter...
EUVD-2026-14535
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly...
EUVD-2026-12097
Parse Server's GraphQL WebSocket endpoint bypasses security middleware...
EUVD-2026-3280
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled...
EUVD-2025-205353
SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users...
EUVD-2025-198258
A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub2.1.0.1567x64rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. Th...
EUVD-2025-180513
Malicious code in acamar-prettier-stylelint-run-script-hapi npm...
EUVD-2025-114227
Malicious code in elara-mini-css-extract-plugin-lynx-grus npm...
EUVD-2021-10081
Malware in sbrugna...
EUVD-2020-15945
Malware in sbrugna...
EUVD-2021-24216
Malware in sbrugna...
EUVD-2021-24388
Malware in sbrugna...
EUVD-2016-9230
Malware in sbrugna...
EUVD-2021-21472
Malware in sbrugna...
EUVD-2019-7057
Malware in sbrugna...
EUVD-2021-0760
Malware in sbrugna...
EUVD-2021-16051
Malware in sbrugna...
EUVD-2023-34498
Malicious code in bioql PyPI...
EUVD-2022-7282
Malicious code in bioql PyPI...
EUVD-2025-26335
Malicious code in bioql PyPI...
EUVD-2025-12150
Malicious code in bioql PyPI...
EUVD-2022-42313
Malicious code in bioql PyPI...
EUVD-2025-16622
Malicious code in bioql PyPI...
EUVD-2023-35115
Malicious code in bioql PyPI...
EUVD-2024-27167
Malicious code in bioql PyPI...
EUVD-2023-2924
Malicious code in bioql PyPI...
EUVD-2023-23542
Malicious code in bioql PyPI...
EUVD-2025-12492
Malicious code in bioql PyPI...
EUVD-2025-27086
Malicious code in bioql PyPI...
EUVD-2022-51021
Malicious code in bioql PyPI...
EUVD-2024-0448
Malicious code in bioql PyPI...
EUVD-2022-45013
Malicious code in bioql PyPI...
EUVD-2025-6997
Malicious code in bioql PyPI...
EUVD-2026-73812
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...
EUVD-2026-73690
Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network...
EUVD-2026-73681
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
EUVD-2026-59808
A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function getstatus of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been...
EUVD-2026-59413
In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...
EUVD-2026-57352
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...
EUVD-2026-55743
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...
EUVD-2026-54950
A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component readrangeconfig. The manipulation of the argument Source leads to server-side request forgery. The attack may be...
EUVD-2026-53371
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...
EUVD-2026-52031
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...
EUVD-2026-51537
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
EUVD-2026-51416
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...
EUVD-2026-49397
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...