452345 matches found
EUVD-2026-25264
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi...
EUVD-2026-23498
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings e.g., enabling SSH, allowing unauthorized state changes that can facilitate later compromise...
EUVD-2026-22579
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
EUVD-2026-18919
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, executecode in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safegetattr wrapper, achieving arbitrary ...
EUVD-2026-17636
PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, checksharedaccessallowed validates only session existence — it does not check SharedPdf.inactive expiration / max views or SharedPdf.deleted. The Serve and...
EUVD-2026-2912
In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such...
EUVD-2026-1350
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ualshookwploginfailed' lacks a capability check and writes failed usernames directly into updateoption calls. This makes it possible for unauthenticated attacker...
EUVD-2025-205780
Picklescan is vulnerable to RCE via missing detection when calling built-in python operator.attrgetter...
EUVD-2025-178264
Malicious code in joviology-mocha-cluster-redshift npm...
EUVD-2025-76168
Malicious code in notablecockroach-toolteadev npm...
EUVD-2025-35062
In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix memory leak by freeing untracked persist buffer One internal buffer which is allocated only once per session was not being freed during session close because it was not being tracked as part of internal buffer li...
EUVD-2020-26234
Malware in sbrugna...
EUVD-2019-0248
Malware in sbrugna...
EUVD-2021-20523
Malware in sbrugna...
EUVD-2021-24251
Malware in sbrugna...
EUVD-2021-21417
Malware in sbrugna...
EUVD-2010-2454
Malware in sbrugna...
EUVD-2020-18370
Malware in sbrugna...
EUVD-2020-27897
Malware in sbrugna...
EUVD-2022-7473
Malicious code in bioql PyPI...
EUVD-2024-17621
Malicious code in bioql PyPI...
EUVD-2021-30821
Malicious code in bioql PyPI...
EUVD-2024-36763
Malicious code in bioql PyPI...
EUVD-2021-27595
Malicious code in bioql PyPI...
EUVD-2025-27665
Malicious code in bioql PyPI...
EUVD-2025-18212
Malicious code in bioql PyPI...
EUVD-2024-2335
Malicious code in bioql PyPI...
EUVD-2024-34446
Malicious code in bioql PyPI...
EUVD-2021-32802
Malicious code in bioql PyPI...
EUVD-2022-38189
Malicious code in bioql PyPI...
EUVD-2024-42717
Malicious code in bioql PyPI...
EUVD-2022-39469
Malicious code in bioql PyPI...
EUVD-2024-0448
Malicious code in bioql PyPI...
EUVD-2025-24243
Malicious code in bioql PyPI...
EUVD-2025-19921
Malicious code in bioql PyPI...
EUVD-2024-18415
Malicious code in bioql PyPI...
EUVD-2025-23144
Malicious code in bioql PyPI...
EUVD-2026-67470
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...
EUVD-2026-60773
A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...
EUVD-2026-59808
A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function getstatus of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been...
EUVD-2026-57871
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
EUVD-2026-56651
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
EUVD-2026-56612
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally...
EUVD-2025-210674
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
EUVD-2026-48310
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
EUVD-2026-45004
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...
EUVD-2026-43028
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO OAuth Client allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO OAuth Client: from n/a through 38.5.8...
EUVD-2026-42975
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access an...
EUVD-2026-42544
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an...
EUVD-2026-42244
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory 'path...