469045 matches found
EUVD-2022-4499
Malicious code in bioql PyPI...
EUVD-2022-7683
Malicious code in bioql PyPI...
EUVD-2023-12462
Malicious code in bioql PyPI...
EUVD-2025-21120
Malicious code in bioql PyPI...
EUVD-2022-52729
Malicious code in bioql PyPI...
EUVD-2025-12975
Malicious code in bioql PyPI...
EUVD-2025-16056
Malicious code in bioql PyPI...
EUVD-2023-34410
Malicious code in bioql PyPI...
EUVD-2023-41815
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Creative Solutions Contact Form Generator plugin = 2.5.5 versions...
EUVD-2026-97045
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...
EUVD-2026-44646
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification...
EUVD-2026-44642
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents...
EUVD-2025-209815
An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability...
EUVD-2026-81298
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...
EUVD-2026-75437
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
EUVD-2026-73911
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...
EUVD-2026-73814
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-73810
Use after free in Windows Security Health Service allows an authorized attacker to elevate privileges locally...
EUVD-2026-73767
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
EUVD-2026-73742
Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...
EUVD-2026-70654
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
EUVD-2026-70138
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
EUVD-2026-68790
Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...
EUVD-2026-66368
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...
EUVD-2026-67870
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...
EUVD-2026-57800
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...
EUVD-2026-56771
Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network...
EUVD-2026-52885
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...
EUVD-2026-52581
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
EUVD-2026-52446
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...
EUVD-2026-51925
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...
EUVD-2026-51742
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2026-51162
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...
EUVD-2026-43723
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...
EUVD-2026-42631
Open WebUI: /api/v1/channels/id/members exposes full user model including sensitive credentials...
EUVD-2026-48430
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...
EUVD-2026-46690
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
EUVD-2026-46414
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...
EUVD-2026-44395
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability...
EUVD-2026-42577
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement...
EUVD-2026-41559
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...
EUVD-2026-46047
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
EUVD-2026-45634
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfsreadgaps Fix netfsreadgaps to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITERBVEC-class iterator is created that ha...
EUVD-2026-45169
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a by default six-character string. The built-in rand function is...
EUVD-2026-45148
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders...
EUVD-2026-44869
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...
EUVD-2026-44664
Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
EUVD-2026-44561
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed...