468775 matches found
EUVD-2022-2081
Malicious code in bioql PyPI...
EUVD-2023-34988
Malicious code in bioql PyPI...
EUVD-2024-50519
Malicious code in bioql PyPI...
EUVD-2023-24189
Malicious code in bioql PyPI...
EUVD-2021-6821
Malicious code in bioql PyPI...
EUVD-2024-31296
Malicious code in bioql PyPI...
EUVD-2025-27018
Malicious code in bioql PyPI...
EUVD-2025-17796
Malicious code in bioql PyPI...
EUVD-2023-2620
Malicious code in bioql PyPI...
EUVD-2025-5077
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
EUVD-2026-92078
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...
EUVD-2026-92065
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28...
EUVD-2023-60702
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...
EUVD-2026-81323
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled...
EUVD-2026-75010
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems...
EUVD-2026-73913
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...
EUVD-2026-73774
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network...
EUVD-2026-73671
Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally...
EUVD-2026-73124
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...
EUVD-2026-70702
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-69458
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script...
EUVD-2026-69138
A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover...
EUVD-2026-64632
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...
EUVD-2026-61341
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle...
EUVD-2026-60506
The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to a denial-of-service...
EUVD-2026-60352
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...
EUVD-2026-59667
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...
EUVD-2026-59233
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISOEND/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISOCONT, ISOEND packets. We currently reject them if they are last. If controller sends malformed sequence ISOSTA...
EUVD-2026-59066
In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...
EUVD-2026-58639
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...
EUVD-2026-58511
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...
EUVD-2026-57881
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
EUVD-2026-57852
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
EUVD-2026-51689
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
EUVD-2026-51517
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
EUVD-2026-51506
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...
EUVD-2026-42616
Open WebUI: Stored web worker XSS via Pyodide...
EUVD-2026-48310
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
EUVD-2026-47442
Vulnerability in the Oracle HRMS Japanese product of Oracle E-Business Suite component: Oracle Payroll Japanese. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HRMS...
EUVD-2026-46309
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
EUVD-2026-45403
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the argument day results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to...
EUVD-2026-45092
OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...
EUVD-2026-43941
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43794
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally...
EUVD-2026-44246
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Server Network driver allows an unauthorized attacker to execute code over a network...
EUVD-2026-43782
Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...
EUVD-2026-43249
A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...
EUVD-2026-42888
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion...
EUVD-2026-42429
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase in GitHandler.prepare in jupyterlabgit/handlers.py to enforce excludedpaths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded...
EUVD-2026-41837
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...