EUVD-2025-21129

Malicious code in bioql PyPI...

EUVD-2022-35732

Malicious code in bioql PyPI...

EUVD-2022-42721

Malicious code in bioql PyPI...

EUVD-2022-6117

Malicious code in bioql PyPI...

EUVD-2024-43524

Malicious code in bioql PyPI...

EUVD-2023-32094

Malicious code in bioql PyPI...

EUVD-2023-53998

Malicious code in bioql PyPI...

EUVD-2023-33556

Malicious code in bioql PyPI...

EUVD-2022-3811

Malicious code in bioql PyPI...

EUVD-2024-0989

Malicious code in bioql PyPI...

EUVD-2025-24124

Malicious code in bioql PyPI...

EUVD-2025-32055

Malicious code in bioql PyPI...

EUVD-2025-25420

Malicious code in bioql PyPI...

EUVD-2025-21713

Malicious code in bioql PyPI...

EUVD-2025-14242

Malicious code in bioql PyPI...

EUVD-2024-44178

Malicious code in bioql PyPI...

EUVD-2024-39310

Malicious code in bioql PyPI...

EUVD-2022-3680

Malicious code in bioql PyPI...

EUVD-2022-0122

Malicious code in bioql PyPI...

EUVD-2024-1164

Malicious code in bioql PyPI...

EUVD-2024-1397

Malicious code in bioql PyPI...

EUVD-2023-24187

Malicious code in bioql PyPI...

EUVD-2024-49717

Malicious code in bioql PyPI...

EUVD-2025-21789

Malicious code in bioql PyPI...

EUVD-2022-49161

Malicious code in bioql PyPI...

EUVD-2025-16257

Malicious code in bioql PyPI...

EUVD-2025-22383

Malicious code in bioql PyPI...

EUVD-2020-8887

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

EUVD-2026-92262

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

EUVD-2026-81325

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

EUVD-2026-81095

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

EUVD-2026-42683

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

EUVD-2026-75437

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

EUVD-2026-73916

Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network...

EUVD-2026-73881

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-73788

Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-73628

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-73071

Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...

EUVD-2026-72926

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

EUVD-2026-68790

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

EUVD-2026-67718

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

EUVD-2026-67496

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

EUVD-2026-63196

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

EUVD-2026-61383

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In PDF Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

EUVD-2026-61099

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...

EUVD-2026-55806

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...