Lucene search
+L
EuvdMost viewed

453137 matches found

EUVD
EUVD
•added 2026/05/28 9:41 a.m.•35 views

EUVD-2026-32757

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in sctrl Three control cases AUTOGAIN, EXPOSUREAUTO, ANALOGUEGAIN directly return without calling pmruntimeput, causing runtime PM reference count leaks. Change these cases from...

5.7AI score0.00143EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/28 9:41 a.m.•35 views

EUVD-2026-32753

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and cleanups Add checks for ioremap return values in saa7164devsetup. If ioremap for BAR0 or BAR2 fails, release the already allocated PCI memory regions, remove the device from the globa...

5.5AI score0.00162EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/28 4:42 a.m.•35 views

EUVD-2026-32718

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol LDAP server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password...

4.9CVSS5.8AI score0.00895EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/27 3:33 p.m.•35 views

EUVD-2026-32332

In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caifserial ldiscclose There is a use-after-free bug in caifserial where handletx may access ser-tty after the tty has been freed. The race condition occurs between ldiscclose and packet...

5.7AI score0.00171EPSS
SaveExploits0References9
EUVD
EUVD
•added 2026/05/27 3:33 p.m.•35 views

EUVD-2026-32275

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-onl...

7.1CVSS5.7AI score0.00862EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/27 12:58 p.m.•35 views

EUVD-2026-32471

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames advances pointer p through the names buffer while decrementing buflen. If buflen reaches zero but items remain, the next iteration...

5.8AI score0.00162EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/27 12:56 p.m.•35 views

EUVD-2026-32406

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damoncall vs kdamondfn exit race Patch series "mm/damon/core: fix damoncall/damoswalk vs kdmond exit race". damoncall and damoswalk can leak memory and/or deadlock when they race with kdamond terminations. Fix...

5.7AI score0.00109EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/27 9:49 a.m.•35 views

EUVD-2026-32201

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through = 2.1.18...

6.5CVSS5.8AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/27 9:49 a.m.•35 views

EUVD-2026-32188

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.8AI score0.00418EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/27 7:45 a.m.•35 views

EUVD-2026-32116

The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts...

6.1CVSS5.7AI score0.00177EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/27 4:28 a.m.•35 views

EUVD-2025-209950

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

4.3CVSS5.7AI score0.00288EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/26 9:21 p.m.•35 views

EUVD-2026-32007

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of set directives in Velocity templates. If an application renders a template controll...

8.3CVSS5.9AI score0.00606EPSS
SaveExploits2References1
EUVD
EUVD
•added 2026/05/26 7:40 p.m.•35 views

EUVD-2026-31971

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

5.9CVSS5.8AI score0.00367EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/05/26 6:23 p.m.•35 views

EUVD-2026-31954

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application...

9.8CVSS5.8AI score0.00594EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/26 6:23 p.m.•35 views

EUVD-2026-31953

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is...

8.8CVSS5.9AI score0.00571EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/26 5:35 p.m.•35 views

EUVD-2026-31940

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint /auth/v1/introspectaccesstoken accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims...

4.4CVSS5.8AI score0.00102EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/26 5:24 p.m.•35 views

EUVD-2026-31934

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-after-free for stack memory. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code executi...

7CVSS5.9AI score0.00167EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/26 5:20 p.m.•35 views

EUVD-2026-31928

NVIDIA Display Driver for Linux contains a vulnerability where a user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to denial of service and information disclosure...

7.1CVSS5.8AI score0.00166EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/26 5:06 p.m.•35 views

EUVD-2026-31912

Eppendorf BioFlo 320 is vulnerable to due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have...

9.8CVSS5.9AI score0.0074EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/26 4:38 p.m.•35 views

EUVD-2026-31868

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error respon...

7.5CVSS5.8AI score0.00416EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/26 2:08 p.m.•35 views

EUVD-2026-31835

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

8.6CVSS6.6AI score0.01183EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/05/26 11:45 a.m.•35 views

EUVD-2026-31813

A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Handler. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been...

5.3CVSS6AI score0.00191EPSS
SaveExploits1References5
EUVD
EUVD
•added 2026/05/25 8:30 p.m.•35 views

EUVD-2026-31737

A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompressR2004section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has...

4.8CVSS5.3AI score0.00161EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/05/25 6:30 a.m.•35 views

EUVD-2026-31640

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/25 6:15 a.m.•35 views

EUVD-2026-31641

A weakness has been identified in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/25 6:00 a.m.•35 views

EUVD-2026-31642

A vulnerability in MLflow versions =3.10.1.dev0 allows unauthorized access to multipart upload MPU endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/ endpoints, enabling attackers to overwrite...

9CVSS6.3AI score0.00536EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/05/24 11:45 p.m.•35 views

EUVD-2026-31610

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection...

10CVSS5.6AI score0.03253EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/24 1:40 p.m.•35 views

EUVD-2026-31598

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the attnimplementationinternal field set to an attacker-controlled HuggingFac...

7.8CVSS7.8AI score0.00599EPSS
SaveExploits1References2
EUVD
EUVD
•added 2026/05/24 11:00 a.m.•35 views

EUVD-2026-31589

A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is...

4.8CVSS4.2AI score0.0035EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/05/23 4:27 a.m.•35 views

EUVD-2026-31526

The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'exportsettings' function. This function returns the RES...

8.8CVSS5.8AI score0.0045EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 10:04 p.m.•35 views

EUVD-2026-31522

Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00456EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/22 1:23 p.m.•35 views

EUVD-2025-209921

Dell PowerFlex Manager, versions =4.6.2, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering...

6.5CVSS5.8AI score0.00083EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 7:50 a.m.•35 views

EUVD-2026-31418

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for...

5.4CVSS5.8AI score0.00826EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/05/22 3:39 a.m.•35 views

EUVD-2026-31404

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

4.3CVSS5.8AI score0.00354EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/05/22 12:43 a.m.•35 views

EUVD-2026-31387

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information...

7.7CVSS5.8AI score0.00592EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31357

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" . Any authenticated admin or report viewer with access to...

6CVSS5.8AI score0.00236EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31378

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.8AI score0.00214EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31369

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file star. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Dror...

2.3CVSS5.8AI score0.00196EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/22 12:31 a.m.•35 views

EUVD-2026-31352

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The /ccm/frontend/conversations/messagedetail endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and th...

6.3CVSS5.8AI score0.00743EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/20 1:25 a.m.•35 views

EUVD-2026-31042

The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the vcenamadnamad, vcenamadshamed, and vcenamadcustom shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on use...

6.4CVSS6AI score0.00331EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/19 6:33 p.m.•35 views

EUVD-2026-30971

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

6.5CVSS5.5AI score0.00464EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/05/19 12:49 p.m.•35 views

EUVD-2026-30928

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status pages via XENMEMaddtophysmap. Some of the status pages may then be freed while...

7.8CVSS5.8AI score0.00117EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/18 12:30 a.m.•35 views

EUVD-2026-30721

A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has...

9CVSS7.7AI score0.00805EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/18 12:00 a.m.•35 views

EUVD-2026-30780

OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format CPF parser, specifically in CreateCommonPacketFormatStructure in source/src/enetencap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled itemcount value that is not consistently...

6.2CVSS5.8AI score0.0016EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/17 10:45 a.m.•35 views

EUVD-2026-30694

A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. Th...

6.9CVSS5.8AI score0.00675EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/17 5:15 a.m.•35 views

EUVD-2026-30684

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly availab...

6.5CVSS5.5AI score0.00409EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/05/15 8:32 p.m.•35 views

EUVD-2026-30628

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt. However users may...

4.3CVSS5.8AI score0.00311EPSS
SaveExploits1References1
EUVD
EUVD
•added 2026/05/15 6:36 p.m.•35 views

EUVD-2026-30602

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solutionidid.html endpoint. Attackers can sequentially...

7.5CVSS5.8AI score0.0043EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/05/15 2:41 a.m.•35 views

EUVD-2025-209876

Insufficient parameter sanitization in AMD Secure Processor ASP TEE SOC Driver could allow an attacker to issue a malformed DRVSOCCMDIDLOADGFXIPFW SR-IOV command to cause out-of-bounds read, potentially resulting in SOC Driver memory contents exposure or an exception...

4.6CVSS5.8AI score0.00112EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/05/14 6:31 p.m.•35 views

EUVD-2026-30362

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modifycrond and /starttask interfaces, it is possible to modify the default built-in scheduled tasks and start...

9.3CVSS6AI score0.01315EPSS
SaveExploits1References1
Total number of security vulnerabilities5000