Lucene search
+L
EuvdMost viewed

453070 matches found

EUVD
EUVD
•added 2026/05/26 11:45 a.m.•35 views

EUVD-2026-31813

A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Handler. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been...

5.3CVSS6AI score0.00191EPSS
SaveExploits1References5
EUVD
EUVD
•added 2026/05/25 8:30 p.m.•35 views

EUVD-2026-31737

A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompressR2004section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has...

4.8CVSS5.3AI score0.00161EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/05/25 6:30 a.m.•35 views

EUVD-2026-31640

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/25 6:15 a.m.•35 views

EUVD-2026-31641

A weakness has been identified in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/25 6:00 a.m.•35 views

EUVD-2026-31642

A vulnerability in MLflow versions =3.10.1.dev0 allows unauthorized access to multipart upload MPU endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/ endpoints, enabling attackers to overwrite...

9CVSS6.3AI score0.00536EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/05/24 11:45 p.m.•35 views

EUVD-2026-31610

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/24 1:40 p.m.•35 views

EUVD-2026-31598

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the attnimplementationinternal field set to an attacker-controlled HuggingFac...

7.8CVSS7.8AI score0.00599EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/05/24 11:00 a.m.•35 views

EUVD-2026-31589

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is...

4.8CVSS4.2AI score0.0035EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/23 4:27 a.m.•35 views

EUVD-2026-31526

The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'exportsettings' function. This function returns the RES...

8.8CVSS5.8AI score0.0045EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 10:04 p.m.•35 views

EUVD-2026-31522

Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00456EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/22 1:23 p.m.•35 views

EUVD-2025-209921

Dell PowerFlex Manager, versions =4.6.2, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering...

6.5CVSS5.8AI score0.00083EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 7:50 a.m.•35 views

EUVD-2026-31418

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

5.4CVSS5.8AI score0.00826EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/05/22 3:39 a.m.•35 views

EUVD-2026-31404

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

4.3CVSS5.8AI score0.00354EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31357

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" . Any authenticated admin or report viewer with access to...

6CVSS5.8AI score0.00236EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31378

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.8AI score0.00214EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31369

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file star. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Dror...

2.3CVSS5.8AI score0.00196EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31352

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The /ccm/frontend/conversations/messagedetail endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and th...

6.3CVSS5.8AI score0.00743EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/20 1:25 a.m.•35 views

EUVD-2026-31042

The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the vcenamadnamad, vcenamadshamed, and vcenamadcustom shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on use...

6.4CVSS6AI score0.00331EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/19 6:33 p.m.•35 views

EUVD-2026-30971

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

6.5CVSS5.5AI score0.00464EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/19 12:49 p.m.•35 views

EUVD-2026-30928

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status pages via XENMEMaddtophysmap. Some of the status pages may then be freed while...

7.8CVSS5.8AI score0.00117EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/18 12:30 a.m.•35 views

EUVD-2026-30721

A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has...

9CVSS7.7AI score0.00805EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/18 12:00 a.m.•35 views

EUVD-2026-30780

OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format CPF parser, specifically in CreateCommonPacketFormatStructure in source/src/enetencap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled itemcount value that is not consistently...

6.2CVSS5.8AI score0.0016EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/17 9:00 a.m.•35 views

EUVD-2026-30691

A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ranuefindbyamfuengapid of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been made public...

6.5CVSS6.1AI score0.00387EPSS
SaveExploits1References7
EUVD
EUVD
•added 2026/05/17 5:15 a.m.•35 views

EUVD-2026-30684

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly availab...

6.5CVSS5.5AI score0.00409EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/15 9:05 p.m.•35 views

EUVD-2026-30642

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delete, restore, and view the contents of other users' memories...

8.3CVSS5.8AI score0.0042EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/05/15 8:32 p.m.•35 views

EUVD-2026-30628

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt. However users may...

4.3CVSS5.8AI score0.00311EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/05/15 6:36 p.m.•35 views

EUVD-2026-30602

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solutionidid.html endpoint. Attackers can sequentially...

7.5CVSS5.8AI score0.0043EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/15 2:41 a.m.•35 views

EUVD-2025-209876

Insufficient parameter sanitization in AMD Secure Processor ASP TEE SOC Driver could allow an attacker to issue a malformed DRVSOCCMDIDLOADGFXIPFW SR-IOV command to cause out-of-bounds read, potentially resulting in SOC Driver memory contents exposure or an exception...

4.6CVSS5.8AI score0.00112EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/14 6:31 p.m.•35 views

EUVD-2026-30362

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modifycrond and /starttask interfaces, it is possible to modify the default built-in scheduled tasks and start...

9.3CVSS6AI score0.01315EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/05/14 1:00 p.m.•35 views

EUVD-2026-30290

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18...

3.7CVSS6.1AI score0.00275EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/13 6:30 p.m.•35 views

EUVD-2026-30024

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt storm on host controller error HCE The xHCI controller reports a Host Controller Error HCE in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhciirq function and causes...

5.8AI score0.00162EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/05/13 6:30 p.m.•35 views

EUVD-2026-30005

An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

8.7CVSS5.8AI score0.00408EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/13 1:27 p.m.•35 views

EUVD-2026-29952

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pmsetgrouporder, pmsetgroupitem...

4.3CVSS5.8AI score0.00385EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/05/12 9:31 p.m.•35 views

EUVD-2026-29751

Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may...

7.5CVSS5.8AI score0.00329EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 6:30 p.m.•35 views

EUVD-2026-29679

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network...

8.8CVSS5.8AI score0.00778EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 6:30 p.m.•35 views

EUVD-2026-29635

Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally...

8.8CVSS5.8AI score0.00298EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 6:30 p.m.•35 views

EUVD-2026-29642

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

7.8CVSS5.8AI score0.00466EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 6:30 p.m.•35 views

EUVD-2026-29601

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally...

7CVSS5.9AI score0.00202EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 4:58 p.m.•35 views

EUVD-2026-29694

Improper neutralization of script-related html tags in a web page basic xss in Visual Studio Code allows an unauthorized attacker to execute code locally...

7.8CVSS6AI score0.00504EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/12 12:32 p.m.•35 views

EUVD-2026-29429

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performin...

7.7CVSS5.8AI score0.00166EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/12 9:31 a.m.•35 views

EUVD-2026-29405

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints gwd-backup.php and gwd-logs.php not verifying authentication when the API key has not been...

4.8CVSS6.5AI score0.00429EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/12 9:31 a.m.•35 views

EUVD-2026-29396

The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

6.4CVSS6AI score0.00321EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/11 6:31 p.m.•35 views

EUVD-2026-29081

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

9.9CVSS6.1AI score0.00651EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/11 9:30 a.m.•35 views

EUVD-2026-29037

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpcinputcallevent and the RESPONSE handler in rxrpcverifyresponse copy the skb to a linear one before calling into the security o...

7.8CVSS6.7AI score0.02257EPSS
SaveExploits22References4
EUVD
EUVD
•added 2026/05/10 3:31 p.m.•35 views

EUVD-2022-55989

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The datecreated, datefrom, dateto, and createdat parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET reques...

6.1CVSS5.7AI score0.00252EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/09 12:34 a.m.•35 views

EUVD-2026-28875

Spring AI's MilvusVectorStoredoDeleteList implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 o...

8.6CVSS5.8AI score0.00392EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/08 3:31 p.m.•35 views

EUVD-2026-28579

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed...

5.8AI score0.0016EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/08 12:31 a.m.•35 views

EUVD-2026-28451

Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...

9CVSS6AI score0.00806EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/07 3:38 p.m.•35 views

EUVD-2026-28358

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...

8.8CVSS5.8AI score0.0045EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/07 9:31 a.m.•35 views

EUVD-2026-28330

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elementor Addons: from n/a before 1.7.1053...

5.3CVSS5.8AI score0.00313EPSS
SaveExploits0References2
Total number of security vulnerabilities5000