EUVD-2025-20091

Malicious code in bioql PyPI...

EUVD-2023-34054

Malicious code in bioql PyPI...

EUVD-2023-27884

Malicious code in bioql PyPI...

EUVD-2025-22780

Malicious code in bioql PyPI...

EUVD-2025-16257

Malicious code in bioql PyPI...

EUVD-2022-4025

Malicious code in bioql PyPI...

EUVD-2023-24775

Malicious code in bioql PyPI...

EUVD-2022-38715

Malicious code in bioql PyPI...

EUVD-2023-40005

Malicious code in bioql PyPI...

EUVD-2025-14255

Malicious code in bioql PyPI...

EUVD-2026-42475

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint...

EUVD-2026-73178

Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-70702

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70332

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devresreleaseall unmaps the aperture before the DRM device release callback fires...

EUVD-2026-69736

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-64632

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

EUVD-2026-62587

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

EUVD-2026-61204

Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privilege...

EUVD-2026-60480

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...

EUVD-2026-59681

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...

EUVD-2026-40240

nltk: Arbitrary File Read via Path Traversal in nltk.data.load through Percent-Encoded Sequences...

EUVD-2026-57725

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

EUVD-2026-57550

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore...

EUVD-2026-55270

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

EUVD-2026-52896

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

EUVD-2026-51517

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

EUVD-2026-51502

A provisioning script used when installing HIPASE-250 formerly 250 SCALA engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VN...

EUVD-2026-51097

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...

EUVD-2026-43723

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...

EUVD-2026-49058

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

EUVD-2026-41116

AWS CLI: Overly permissive File Permissions...

EUVD-2026-48430

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

EUVD-2026-47869

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

EUVD-2026-42268

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects...

EUVD-2026-47578

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

EUVD-2026-47492

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47486

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of...

EUVD-2026-47266

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystems. The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

EUVD-2026-42323

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision NFC/NFD on macOS APFS/HFS+...

EUVD-2026-42318

Immutable.js List 32-bit trie overflow → unrecoverable DoS...

EUVD-2026-46172

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

EUVD-2026-46138

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/saveajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed public...

EUVD-2026-41559

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...

EUVD-2026-45568

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

EUVD-2026-45354

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

EUVD-2026-45215

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records...

EUVD-2026-45111

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the...

EUVD-2026-45049

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

EUVD-2026-44889

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...