Lucene search
+L
EuvdMost viewed

434772 matches found

EUVD
EUVD
added 2026/06/09 5:6 p.m.27 views

EUVD-2026-35746

Use after free in Windows Network Controller NC Host Agent allows an authorized attacker to deny service locally...

5.5CVSS5.5AI score0.00356EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 4:2 p.m.27 views

EUVD-2026-35472

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the modverto HTTP request handler allocates a fixed 2 MiB buffer for a POST...

9.8CVSS5.6AI score0.00394EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 1:11 p.m.27 views

EUVD-2026-35423

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can...

4.9CVSS5.7AI score0.00282EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/09 7:42 a.m.27 views

EUVD-2026-35374

The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...

6.5CVSS5.6AI score0.00695EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 3:50 a.m.27 views

EUVD-2026-35331

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

5.9CVSS5.5AI score0.00341EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:49 a.m.27 views

EUVD-2026-35325

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:41 a.m.27 views

EUVD-2026-35313

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...

6.1CVSS5.4AI score0.0012EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/06/09 3:41 a.m.27 views

EUVD-2026-35307

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo and...

7.5CVSS5.5AI score0.00403EPSS
SaveExploits0References11
EUVD
EUVD
added 2026/06/09 12:20 a.m.27 views

EUVD-2026-35280

Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive information .This has a low impact on the confidentiality of the data. There is no impact on integrity and availability of the application...

3.7CVSS5.5AI score0.00188EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/08 4:0 p.m.27 views

EUVD-2026-35125

A security flaw has been discovered in imvks786 studentmanagementsystem up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/adminlogin.php of the component Administrator Login Endpoint. Performing a manipulation of the argument ausr/apwd results in s...

7.5CVSS5.3AI score0.00328EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/08 1:55 a.m.27 views

EUVD-2023-60581

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to creat...

8.7CVSS6.7AI score0.00532EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/08 12:30 a.m.27 views

EUVD-2026-35000

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

5.8CVSS5AI score0.00232EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/06/08 12:15 a.m.27 views

EUVD-2026-35002

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made publi...

7.5CVSS7AI score0.00263EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/06 12:31 a.m.27 views

EUVD-2026-34936

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory...

6.8CVSS5.5AI score0.00163EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/05 8:29 p.m.27 views

EUVD-2026-32923

TinyMCE Cross-Site Scripting XSS vulnerability through mce:protected comments...

8.7CVSS5.4AI score0.00281EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/05 7:54 p.m.27 views

EUVD-2026-34913

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded,...

9.4CVSS6AI score0.00548EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/05 3:0 p.m.27 views

EUVD-2026-34848

A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboardpage/adminpage.php of the component Admin Interface. The manipulation of the argument...

6.5CVSS6.2AI score0.00214EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/04 6:0 p.m.27 views

EUVD-2026-32926

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6...

5.3CVSS5.8AI score0.00244EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/04 3:30 p.m.27 views

EUVD-2026-34274

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component...

5.8AI score0.00547EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/06/04 1:51 a.m.27 views

EUVD-2026-34193

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials Basic auth header or UAA client secret and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access...

7.8CVSS5.8AI score0.00098EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/04 12:30 a.m.27 views

EUVD-2026-34181

OpenStack Ironic through 35.0.x allows Boot Script Injection...

5.8AI score0.00262EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/04 12:30 a.m.27 views

EUVD-2026-34185

A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function datahash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack...

3.6CVSS5AI score0.0012EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/06/04 12:0 a.m.27 views

EUVD-2026-34202

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...

4.9CVSS5.8AI score0.00283EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/03 7:26 p.m.27 views

EUVD-2026-34172

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...

7.3CVSS5.8AI score0.00115EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/03 6:16 p.m.27 views

EUVD-2026-34168

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in...

5.8AI score0.00432EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/06/03 6:7 p.m.27 views

EUVD-2026-34162

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data...

5.7AI score0.00241EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/03 6:3 p.m.27 views

EUVD-2026-34161

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS...

5.8AI score0.00138EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/03 5:53 p.m.27 views

EUVD-2026-34159

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to version 4.11.0, on many of the ECDH shared secret paths, the public key isn't verified to be a point on the correct curve. By...

4.7CVSS5.8AI score0.00096EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/06/03 3:49 p.m.27 views

EUVD-2026-34115

In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistentramsaveold persistentramsaveold can be called multiple times for the same persistentramzone e.g., via ramoopspstoreread - ramoopsgetnextprz for PSTORETYPEDMESG records. Currently, the...

5.9AI score0.00136EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/06/03 3:49 p.m.27 views

EUVD-2026-34110

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link mapping of ahvif-linksmap When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created arvif-iscreated remains false, the error path attempts to...

5.8AI score0.00121EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/03 1:28 p.m.27 views

EUVD-2026-34093

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

5.1CVSS6.1AI score0.00291EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/03 12:0 a.m.27 views

EUVD-2026-34178

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table MSAT in readMSAT is not fully initialized before being consumed by ole2validatesectorchain, which may result in application crashe...

5.8AI score0.00228EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/06/03 12:0 a.m.27 views

EUVD-2026-34140

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding...

5.8AI score0.0018EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/02 4:30 p.m.27 views

EUVD-2026-33981

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been public...

7.5CVSS5.7AI score0.00254EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/02 10:27 a.m.27 views

EUVD-2025-210038

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12...

8.1CVSS5.8AI score0.00415EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/02 7:48 a.m.27 views

EUVD-2026-33893

The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes...

6.4CVSS6AI score0.00181EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/02 12:31 a.m.27 views

EUVD-2026-33798

In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

5.9AI score0.00075EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/02 12:31 a.m.27 views

EUVD-2026-33789

In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

5.5CVSS5.9AI score0.00071EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/02 12:31 a.m.27 views

EUVD-2026-33768

In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

5.5CVSS5.9AI score0.00071EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/01 6:31 p.m.27 views

EUVD-2026-33701

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load with unrestricted deserialization...

7.8CVSS6.2AI score0.00144EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/01 5:49 p.m.27 views

EUVD-2026-33733

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

5.7CVSS5.8AI score0.00211EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/01 5:20 p.m.27 views

EUVD-2026-33723

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with...

8.2CVSS5.8AI score0.00315EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/01 5:13 p.m.27 views

EUVD-2026-33720

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended th...

6.8CVSS5.7AI score0.00252EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/01 5:8 p.m.27 views

EUVD-2026-33716

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication 2FA protections...

5.9CVSS5.7AI score0.0029EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/01 4:59 p.m.27 views

EUVD-2026-33711

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees. The sharing restrictions, applied t...

4.3CVSS5.8AI score0.00281EPSS
SaveExploits1References4
EUVD
EUVD
added 2026/06/01 4:22 p.m.27 views

EUVD-2026-33668

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcalltarget that cifs.upcall treats as kernel-originating inputs. However,...

7.8CVSS5.8AI score0.00377EPSS
SaveExploits4References8
EUVD
EUVD
added 2026/06/01 2:54 p.m.27 views

EUVD-2026-33657

Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1...

9.8CVSS5.8AI score0.00331EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/01 10:0 a.m.27 views

EUVD-2026-33621

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects the function creategenericname of the file /ShowForm/creategenericname/main. The manipulation of the argument genericname results in cross site scripting. The attack may be launched...

5.1CVSS4.3AI score0.00199EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/01 9:3 a.m.27 views

EUVD-2026-33610

SOPlanning is vulnerable to Stored Cross-Site Scripting XSS via /process/uploadbackup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the...

8.8CVSS5.9AI score0.00295EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/01 7:53 a.m.27 views

EUVD-2026-33594

Apache Airflow's EmailOperator and the underlying airflow.utils.email helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used email smtpstarttls=True without email smtpssl. An attacker positioned between the worker and the configured SMTP...

5.9CVSS5.9AI score0.00268EPSS
SaveExploits0References2
Total number of security vulnerabilities5000