Lucene search
+L
EuvdMost viewed

453516 matches found

EUVD
EUVD
•added 2026/04/23 7:12 p.m.•36 views

EUVD-2026-25284

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment JSON injection vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objec...

8.1CVSS7.2AI score0.00483EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/04/23 6:33 p.m.•36 views

EUVD-2026-25261

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi...

6.5CVSS6.1AI score0.00666EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/04/23 12:31 p.m.•37 views

EUVD-2026-25215

The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the...

8.7CVSS5.9AI score0.00313EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/22 7:23 p.m.•36 views

EUVD-2026-25056

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...

5.3CVSS5.8AI score0.00507EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/22 6:30 a.m.•36 views

EUVD-2026-24599

The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

7.1CVSS6AI score0.00462EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/21 9:31 p.m.•36 views

EUVD-2026-24455

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...

7.5CVSS5.7AI score0.00146EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/04/21 6:31 p.m.•36 views

EUVD-2026-24147

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure...

7.7CVSS5.8AI score0.00235EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/20 11:08 p.m.•36 views

EUVD-2026-24006

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified authorization state. Authenticated operator clients can spoof ACP...

7.1CVSS5.8AI score0.00352EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/04/17 6:31 p.m.•36 views

EUVD-2026-22855

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all pg modules.This issue affects BC-JAVA: before 1.84. Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion...

8.7CVSS5.8AI score0.00882EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/16 6:14 p.m.•36 views

EUVD-2026-23284

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the...

8.7CVSS6AI score0.00487EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/04/15 3:31 p.m.•36 views

EUVD-2026-22925

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges...

6.6CVSS5.9AI score0.00155EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/04/14 1:03 a.m.•36 views

EUVD-2026-22191

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged resu...

3.1CVSS5.9AI score0.00346EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/14 12:56 a.m.•36 views

EUVD-2026-22186

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export feature is vulnerable to Improper Neutralization of Formula Elements in a CSV File. When an administrator exports the application chat history to an Excel file .xlsx via the...

8.8CVSS5.8AI score0.0066EPSS
SaveExploits1References3
EUVD
EUVD
•added 2026/04/14 12:06 a.m.•36 views

EUVD-2026-20473

Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables...

7.4CVSS5.8AI score0.00613EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/04/11 12:15 a.m.•36 views

EUVD-2026-21633

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

7.8CVSS7.6AI score0.00601EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/04/08 9:33 p.m.•36 views

EUVD-2025-209351

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /usergroup.asp endpoint. The attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, mem, pri, and attr...

6.2AI score0.00605EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/04/02 3:31 p.m.•37 views

EUVD-2026-18206

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers URIs that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information...

7.3CVSS5.8AI score0.00588EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/04/01 8:00 p.m.•36 views

EUVD-2026-18009

Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email...

9.1CVSS5.8AI score0.00692EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/30 6:31 p.m.•36 views

EUVD-2026-17097

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the addcustomer.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HT...

6AI score0.0031EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/03/27 8:34 p.m.•36 views

EUVD-2026-16820

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environmen...

8.6CVSS6AI score0.0057EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/03/26 9:31 p.m.•36 views

EUVD-2026-16338

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

5.4CVSS5.7AI score0.00263EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/03/26 6:31 p.m.•36 views

EUVD-2026-16245

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint...

4.3CVSS5.8AI score0.0027EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/03/23 9:36 p.m.•36 views

EUVD-2026-14599

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intend...

9.3CVSS5.8AI score0.0043EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/21 6:30 a.m.•36 views

EUVD-2026-13993

The Reward Video Ad for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6. This is due to insufficient input sanitization and output escaping on plugin settings such as the 'Account ID', 'Message before the...

4.4CVSS6AI score0.00245EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/03/19 10:06 p.m.•36 views

EUVD-2026-13253

OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this by claiming the node role during WebSocket handshake to inject...

5.4CVSS5.8AI score0.0038EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/16 6:32 p.m.•36 views

EUVD-2026-12454

LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries...

5.8AI score0.00487EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/11 12:31 a.m.•36 views

EUVD-2026-10944

Illustrator versions 29.8.4, 30.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS6.3AI score0.00337EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/03/10 6:46 p.m.•36 views

EUVD-2026-10789

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

8.2CVSS5.9AI score0.01042EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/03/10 6:31 p.m.•36 views

EUVD-2026-10501

An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges...

7.8CVSS5.8AI score0.00395EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/03/10 12:57 a.m.•36 views

EUVD-2026-10547

Parse Server has denylist requestKeywordDenylist keyword scan bypass through nested object placement...

6.9CVSS5.8AI score0.00411EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/05 10:00 p.m.•36 views

EUVD-2026-9936

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service...

6.8CVSS5.9AI score0.00472EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/03/04 6:31 p.m.•36 views

EUVD-2019-19732

FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login endpoint. Attackers can exploit the vulnerable password parameter in requests to...

8.8CVSS6AI score0.00453EPSS
SaveExploits1References3
EUVD
EUVD
•added 2026/02/27 9:44 p.m.•36 views

EUVD-2026-9083

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the redirecttotarget function in Gradio's OAuth flow accepts an unvalidated targeturl query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback...

4.3CVSS6AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/02/26 3:30 p.m.•36 views

EUVD-2026-8853

A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a built-in startup script. All instances after January 30th, 2026 have been patched to protect from this vulnerability. No...

8.4CVSS5.5AI score0.00235EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/01/29 5:35 p.m.•36 views

EUVD-2026-4963

The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, and 1.11.2, permissions of the Icinga for Windows certificate directory grant every user read access, which results in...

6.8CVSS5.9AI score0.00102EPSS
SaveExploits2References3
EUVD
EUVD
•added 2026/01/27 3:55 p.m.•36 views

EUVD-2026-4810

Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30...

9.1CVSS5.9AI score0.00288EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/01/27 8:41 a.m.•36 views

EUVD-2026-4757

NULL Pointer Dereference vulnerability in visualfc liteide liteidex/src/3rdparty/libvterm/src modules. This vulnerability is associated with program files screen.C, state.C, vterm.C. This issue affects liteide: before x38.4...

6.7CVSS5.9AI score0.00146EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/01/22 9:07 a.m.•36 views

EUVD-2026-4194

Malicious code in @alluxio/common-ui npm...

5.5AI score
SaveExploits0References1
EUVD
EUVD
•added 2026/01/21 12:04 p.m.•36 views

EUVD-2026-3683

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control...

2.7CVSS5.4AI score0.00356EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/01/19 9:09 p.m.•36 views

EUVD-2026-3281

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...

6.6CVSS6AI score0.00479EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/01/13 5:57 p.m.•36 views

EUVD-2026-2151

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Management Services allows an authorized attacker to elevate privileges locally...

7.8CVSS6.5AI score0.00297EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/01/08 9:13 p.m.•36 views

EUVD-2026-1462

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles...

6.4AI score
SaveExploits0References4
EUVD
EUVD
•added 2026/01/06 1:47 a.m.•36 views

EUVD-2026-1060

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149879; Issue ID: MSV-4658...

6.7CVSS6.4AI score0.00081EPSS
SaveExploits0References2
EUVD
EUVD
•added 2025/12/31 3:36 p.m.•36 views

EUVD-2025-206012

Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through 1.8.3...

5.3CVSS6.4AI score0.0071EPSS
SaveExploits0References2
EUVD
EUVD
•added 2025/12/24 3:30 p.m.•36 views

EUVD-2025-205215

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthorvmunmaprange might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no...

6.1AI score0.00142EPSS
SaveExploits0References5
EUVD
EUVD
•added 2025/12/16 6:31 p.m.•36 views

EUVD-2025-203820

Mercury D196G d196gv1-cn-up2020-01-0911.21.44 is vulnerable to Buffer Overflow in the function sub404CAEDC via the parameter facpassword...

6.5AI score0.00422EPSS
SaveExploits1References2
EUVD
EUVD
•added 2025/11/17 4:57 p.m.•36 views

EUVD-2025-197806

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource...

7.5CVSS6.8AI score0.00276EPSS
SaveExploits0References2
EUVD
EUVD
•added 2025/11/14 8:33 p.m.•36 views

EUVD-2025-175312

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal...

5.8CVSS6.2AI score0.00493EPSS
SaveExploits0References3
EUVD
EUVD
•added 2025/11/12 7:18 p.m.•36 views

EUVD-2025-142356

Malicious code in diva-banubo-imba npm...

6.6AI score
SaveExploits0
EUVD
EUVD
•added 2025/11/12 4:29 a.m.•36 views

EUVD-2025-115989

Malicious code in bootstrap-link-pino-pretty-betelgeuse npm...

6.6AI score
SaveExploits0
Total number of security vulnerabilities5000