EUVD-2024-27353

Malicious code in bioql PyPI...

EUVD-2021-6550

Malicious code in bioql PyPI...

EUVD-2022-41481

Malicious code in bioql PyPI...

EUVD-2021-30844

Malicious code in bioql PyPI...

EUVD-2023-0042

Malicious code in bioql PyPI...

EUVD-2025-30406

Malicious code in bioql PyPI...

EUVD-2024-18400

Malicious code in bioql PyPI...

EUVD-2026-65223

GitPython: clonefrom/clone omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination...

EUVD-2026-56398

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally...

EUVD-2026-52883

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...

EUVD-2026-52351

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

EUVD-2026-44932

Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...

EUVD-2026-41986

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a...

EUVD-2026-29494

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800...

EUVD-2026-29399

The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saabcancelbooking function in all versions up to, and including, 1.0.8. The nonce check uses && AND instead of || OR,...

EUVD-2026-26884

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

EUVD-2026-20946

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code pepagehashcalc. When processing PE sections for page hashing, the function uses...

EUVD-2026-8643

Basic FTP has Path Traversal Vulnerability in its downloadToDir method...

EUVD-2026-0893

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in putuser loop for DSP events In the DSP event handling code, a putuser loop copies event data. When the user buffer size is not aligned to 4 bytes, it could overwrite beyond the buffer...

EUVD-2025-120608

Malicious code in webdriver-manager-io-betelgeuse-cordelia npm...

EUVD-2025-37372

Totolink LR350 v9.3.5u.6369B20220309 was discovered to contain a stack overflow via the password parameter in the sub426EF8 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

EUVD-2021-10082

Malware in sbrugna...

EUVD-2016-10742

Malware in sbrugna...

EUVD-2005-1907

Malware in sbrugna...

EUVD-2019-0193

Malware in sbrugna...

EUVD-2018-4605

Malware in sbrugna...

EUVD-2019-5992

Malware in sbrugna...

EUVD-2018-16804

Malware in sbrugna...

EUVD-2023-26162

Malicious code in bioql PyPI...

EUVD-2025-12213

Malicious code in bioql PyPI...

EUVD-2022-30933

Malicious code in bioql PyPI...

EUVD-2024-34736

Malicious code in bioql PyPI...

EUVD-2021-7958

Malicious code in bioql PyPI...

EUVD-2024-35250

Malicious code in bioql PyPI...

EUVD-2024-29789

Malicious code in bioql PyPI...

EUVD-2021-28094

Malicious code in bioql PyPI...

EUVD-2024-26766

Malicious code in bioql PyPI...

EUVD-2023-59768

Malicious code in bioql PyPI...

EUVD-2026-67962

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...

EUVD-2026-56627

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

EUVD-2026-56616

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...

EUVD-2025-210673

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid...

EUVD-2026-41976

mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbcfindmethod...

EUVD-2026-40858

Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in bufappendstring buf.h:61 converts the string length to a large negative sizet,...

EUVD-2018-21910

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksifoto.php, aksiuser.php, and aksikecamatan.php to execute arbitrary...

EUVD-2026-31774

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes the tar header's linkname to symlink without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular...

EUVD-2026-31206

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the getsponsoredmeta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2026-30139

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server...

EUVD-2026-27825

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An...

EUVD-2026-24004

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can terminate running subagent sessions by sending requests to this endpoint, bypassing authorization controls...