Lucene search
+L
EuvdMost viewed

434778 matches found

EUVD
EUVD
added 2026/06/13 7:51 a.m.27 views

EUVD-2026-36647

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.9. This is due to the pagelayersavecontent AJAX handler allowing users with basic post-edit capability to persist...

5.3CVSS5.4AI score0.00297EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/13 12:34 a.m.27 views

EUVD-2026-36630

Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed...

5.3AI score0.00118EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/12 8:45 p.m.27 views

EUVD-2026-36569

A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/AddProjects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched...

5.1CVSS3.7AI score0.00203EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/12 7:32 p.m.27 views

EUVD-2026-35397

TYPO3 CMS has Broken Access Control in its DataHandler...

5.3CVSS5.2AI score0.00238EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/12 7:9 p.m.27 views

EUVD-2026-35401

TYPO3 CMS has Insecure Deserialization via Core API...

6.3CVSS5.2AI score0.00215EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/12 7:8 p.m.27 views

EUVD-2026-35399

TYPO3 CMS has Broken Access Control in Backend API...

5.3CVSS5.2AI score0.00238EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/12 2:49 p.m.27 views

EUVD-2026-36463

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

4.4CVSS5.3AI score0.00333EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/11 6:38 p.m.27 views

EUVD-2026-36288

Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port...

7.7CVSS5.5AI score0.00209EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/10 10:23 p.m.27 views

EUVD-2026-36168

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

4.3CVSS5.4AI score0.00279EPSS
SaveExploits1References4
EUVD
EUVD
added 2026/06/10 9:9 p.m.27 views

EUVD-2026-36153

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUTVALUE messages whose keys bypass all content validation. N...

7.5CVSS5.4AI score0.00354EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/10 12:32 p.m.27 views

EUVD-2026-36003

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted...

7.3CVSS5.4AI score0.00119EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/10 12:31 a.m.27 views

EUVD-2026-35911

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

6.8CVSS5.5AI score0.00116EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/10 12:31 a.m.27 views

EUVD-2026-35905

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

7.5CVSS5.5AI score0.00306EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/10 12:31 a.m.27 views

EUVD-2026-35902

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

5.9CVSS5.5AI score0.00331EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/10 12:31 a.m.27 views

EUVD-2026-35888

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

6.1CVSS5.5AI score0.00172EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/10 12:31 a.m.27 views

EUVD-2026-35862

When using $changestreams and $requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement...

7.1CVSS5.4AI score0.0027EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 7:24 p.m.27 views

EUVD-2026-35806

Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this...

6.3CVSS5.6AI score0.00148EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 7:14 p.m.27 views

EUVD-2026-35795

Ellucian Banner Self-Service before the April T2 release 2025-04-23 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting unsanitized input through the toDateFormat request parameter in the...

6.1CVSS5.6AI score0.0022EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/09 6:40 p.m.27 views

EUVD-2026-35792

A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges...

8.7CVSS5.4AI score0.00279EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35715

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser...

5.4CVSS5.5AI score0.0026EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35654

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network...

4.6CVSS7.1AI score0.00505EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35669

Access of resource using incompatible type 'type confusion' in Microsoft Office allows an unauthorized attacker to execute code locally...

8.4CVSS7.2AI score0.00438EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35532

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 on-premises allows an authorized attacker to elevate privileges over a network...

8.8CVSS5.4AI score0.0063EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35467

An improper implementation of TLS certificate validation vulnerability found in ReadyCloud client app which can allow an attacker to perform attacker-in-the-middle MiTM style attacks impacting product's confidentiality. This vulnerability affects the listed NETGEAR models...

8.2CVSS5.4AI score0.00135EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/06/09 6:30 p.m.27 views

EUVD-2026-35444

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root...

7.2CVSS6.3AI score0.34454EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 5:6 p.m.27 views

EUVD-2026-35753

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...

7.8CVSS5.4AI score0.00267EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 5:6 p.m.27 views

EUVD-2026-35746

Use after free in Windows Network Controller NC Host Agent allows an authorized attacker to deny service locally...

5.5CVSS5.5AI score0.00356EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 4:2 p.m.27 views

EUVD-2026-35472

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the modverto HTTP request handler allocates a fixed 2 MiB buffer for a POST...

9.8CVSS5.6AI score0.00394EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 1:11 p.m.27 views

EUVD-2026-35423

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can...

4.9CVSS5.7AI score0.00282EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/09 7:42 a.m.27 views

EUVD-2026-35374

The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...

6.5CVSS5.6AI score0.00695EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/09 3:50 a.m.27 views

EUVD-2026-35331

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

5.9CVSS5.5AI score0.00341EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:49 a.m.27 views

EUVD-2026-35325

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:41 a.m.27 views

EUVD-2026-35313

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...

6.1CVSS5.4AI score0.0012EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/06/09 3:41 a.m.27 views

EUVD-2026-35307

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo and...

7.5CVSS5.5AI score0.00403EPSS
SaveExploits0References11
EUVD
EUVD
added 2026/06/09 12:20 a.m.27 views

EUVD-2026-35280

Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive information .This has a low impact on the confidentiality of the data. There is no impact on integrity and availability of the application...

3.7CVSS5.5AI score0.00188EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/08 4:0 p.m.27 views

EUVD-2026-35125

A security flaw has been discovered in imvks786 studentmanagementsystem up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/adminlogin.php of the component Administrator Login Endpoint. Performing a manipulation of the argument ausr/apwd results in s...

7.5CVSS5.3AI score0.00328EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/08 1:55 a.m.27 views

EUVD-2023-60581

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to creat...

8.7CVSS6.7AI score0.00532EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/08 12:30 a.m.27 views

EUVD-2026-35000

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

5.8CVSS5AI score0.00232EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/06/08 12:15 a.m.27 views

EUVD-2026-35002

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made publi...

7.5CVSS7AI score0.00263EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/06 12:31 a.m.27 views

EUVD-2026-34936

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory...

6.8CVSS5.5AI score0.00163EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/05 8:29 p.m.27 views

EUVD-2026-32923

TinyMCE Cross-Site Scripting XSS vulnerability through mce:protected comments...

8.7CVSS5.4AI score0.00281EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/05 7:54 p.m.27 views

EUVD-2026-34913

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded,...

9.4CVSS6AI score0.00548EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/05 3:0 p.m.27 views

EUVD-2026-34848

A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboardpage/adminpage.php of the component Admin Interface. The manipulation of the argument...

6.5CVSS6.2AI score0.00214EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/04 6:0 p.m.27 views

EUVD-2026-32926

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6...

5.3CVSS5.8AI score0.00244EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/04 3:30 p.m.27 views

EUVD-2026-34274

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component...

5.8AI score0.00547EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/06/04 1:51 a.m.27 views

EUVD-2026-34193

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials Basic auth header or UAA client secret and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access...

7.8CVSS5.8AI score0.00098EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/04 12:30 a.m.27 views

EUVD-2026-34185

A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function datahash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack...

3.6CVSS5AI score0.0012EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/06/04 12:30 a.m.27 views

EUVD-2026-34181

OpenStack Ironic through 35.0.x allows Boot Script Injection...

5.8AI score0.00262EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/04 12:0 a.m.27 views

EUVD-2026-34202

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...

4.9CVSS5.8AI score0.00283EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/03 7:26 p.m.27 views

EUVD-2026-34172

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...

7.3CVSS5.8AI score0.00115EPSS
SaveExploits0References1
Total number of security vulnerabilities5000