EUVD-2025-20299

Malicious code in bioql PyPI...

EUVD-2025-21024

Malicious code in bioql PyPI...

EUVD-2023-32327

Malicious code in bioql PyPI...

EUVD-2024-30434

Malicious code in bioql PyPI...

EUVD-2025-16056

Malicious code in bioql PyPI...

EUVD-2025-10986

Malicious code in bioql PyPI...

EUVD-2025-23520

Malicious code in bioql PyPI...

EUVD-2025-25001

Malicious code in bioql PyPI...

EUVD-2022-27225

Malicious code in bioql PyPI...

EUVD-2025-22308

Malicious code in bioql PyPI...

EUVD-2023-49520

Malicious code in bioql PyPI...

EUVD-2024-28460

Malicious code in bioql PyPI...

EUVD-2022-51060

Malicious code in bioql PyPI...

EUVD-2025-23050

Malicious code in bioql PyPI...

EUVD-2023-1314

Malicious code in bioql PyPI...

EUVD-2022-53410

Malicious code in bioql PyPI...

EUVD-2022-30398

Malicious code in bioql PyPI...

EUVD-2024-43228

Malicious code in bioql PyPI...

EUVD-2024-47276

Malicious code in bioql PyPI...

EUVD-2021-9355

Malicious code in bioql PyPI...

EUVD-2024-50065

Malicious code in bioql PyPI...

EUVD-2025-14508

Malicious code in bioql PyPI...

EUVD-2022-4025

Malicious code in bioql PyPI...

EUVD-2024-18096

Malicious code in bioql PyPI...

EUVD-2023-41186

Malicious code in bioql PyPI...

EUVD-2025-18966

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

EUVD-2026-44646

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification...

EUVD-2025-209822

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getticketcontentcallback' function in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to view any...

EUVD-2026-44647

Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

EUVD-2026-74431

UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-74529

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-73869

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-73684

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

EUVD-2026-73253

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-72196

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...

EUVD-2026-72028

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

EUVD-2026-70332

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devresreleaseall unmaps the aperture before the DRM device release callback fires...

EUVD-2026-69787

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

EUVD-2026-68284

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

EUVD-2026-43097

Phalcon: Non-constant-time HMAC verification in Encryption\Crypt::decrypt timing side-channel...

EUVD-2026-67488

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

EUVD-2026-63692

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

EUVD-2026-62948

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's tokenserial parameter is not masked...

EUVD-2026-61204

Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privilege...

EUVD-2026-60762

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-60541

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

EUVD-2026-59328

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip...

EUVD-2026-59283

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...