Lucene search
+L
EuvdMost viewed

434180 matches found

EUVD
EUVD
added 2026/05/26 1:6 a.m.26 views

EUVD-2025-209927

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

1.8CVSS5.7AI score0.00264EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/25 10:32 p.m.26 views

EUVD-2026-31750

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7...

6.3CVSS5.8AI score0.00202EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/25 10:0 p.m.26 views

EUVD-2026-31760

A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument webWlanIdx leads to os command injection. It is possible to launch the attack remotely. The...

6.5CVSS6.4AI score0.01057EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/05/25 2:30 p.m.26 views

EUVD-2026-31698

A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotel...

6.9CVSS5.7AI score0.00352EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/25 9:30 a.m.26 views

EUVD-2026-31660

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/editcustomer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed t...

5.8CVSS5.7AI score0.00258EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/05/25 4:15 a.m.26 views

EUVD-2026-31629

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/formWlanMP. The manipulation of the argument...

9CVSS7.6AI score0.00445EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/24 11:45 p.m.26 views

EUVD-2026-31610

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection...

10CVSS5.6AI score0.01732EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/05/24 7:0 p.m.26 views

EUVD-2026-31549

A vulnerability was found in H3C Magic B0 up to 100R002. This affects the function EditBasicSSID5G of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. The...

9CVSS7.6AI score0.00445EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/24 11:15 a.m.27 views

EUVD-2026-31588

A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument regDomain/ABandregDomain/nic0Addr/nic1Addr/wlanAddr/inicAddr results in command injection. It is...

6.5CVSS6.4AI score0.01171EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/24 7:45 a.m.26 views

EUVD-2026-31576

A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNCDECODER of the file src/dissectors/ecgg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The...

6.3CVSS5.7AI score0.00319EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/05/23 1:15 p.m.26 views

EUVD-2026-31537

A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of the file app/index/command/VpsTest.php of the component VpsTest Console. Executing a manipulation of the argument vf can lead to code...

6.5CVSS6.3AI score0.00237EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/05/23 4:27 a.m.26 views

EUVD-2026-31525

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\TeamAccounts::savesettings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with...

8.8CVSS5.8AI score0.00244EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/22 7:39 p.m.26 views

EUVD-2026-31495

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of a saved filter's owner, allowing an attacker to inject arbitrary HTML on systems where $gshowuserrealname = ON. Note that By default, only...

7.5CVSS5.9AI score0.00419EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/05/22 7:10 p.m.26 views

EUVD-2026-31488

Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureAppredirecturl method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET...

6.1CVSS5.8AI score0.00241EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/22 5:27 p.m.26 views

EUVD-2026-31479

TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain an SSRF via Open Redirect Bypass as the HTTP Request block and Code block validate the initial request URL via validateHttpReqUrl to block private IPs and cloud metadata hostnames. However, the HTTP clients ky and fetch follow 3...

7.7CVSS5.8AI score0.00239EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/22 12:31 a.m.26 views

EUVD-2026-31357

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" . Any authenticated admin or report viewer with access to...

6CVSS5.8AI score0.00139EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/22 12:31 a.m.26 views

EUVD-2026-31364

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

2.3CVSS5.8AI score0.00172EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/22 12:0 a.m.26 views

EUVD-2026-31476

In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions...

6AI score0.00132EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/21 1:2 p.m.26 views

EUVD-2025-209912

An origin validation error vulnerability in the Trend Micro Apex One mac agent iCore service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

7.8CVSS7.3AI score0.00357EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/21 1:2 p.m.26 views

EUVD-2025-209911

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerabili...

9.8CVSS7.7AI score0.03811EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/21 8:38 a.m.26 views

EUVD-2026-31251

Honeywell Control Network Module CNM contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing system files, potentially resulting in unintended access to protected data...

5.9CVSS5.8AI score0.00208EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/20 9:16 p.m.26 views

EUVD-2026-31197

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned with a signature field...

7.5CVSS5.9AI score0.00626EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/20 8:25 p.m.26 views

EUVD-2026-31196

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash...

5.8AI score0.00393EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/20 7:12 p.m.26 views

EUVD-2026-31168

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

8.8CVSS6.2AI score0.00396EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/20 12:31 a.m.26 views

EUVD-2026-30992

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

5.8AI score0.00369EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/20 12:31 a.m.26 views

EUVD-2026-30997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Orejime allows Cross-Site Scripting XSS. This issue affects Orejime: from 0.0.0 before 2.0.16...

5.8AI score0.00196EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/19 9:9 p.m.26 views

EUVD-2026-30987

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting XSS vulnerability in the ticket reply notification system. Unsanitized reply content $newmessage is stored directly in database notification payloads and later rendered...

8.7CVSS6AI score0.00349EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/19 11:1 a.m.26 views

EUVD-2026-30888

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect OIDC clients. By manipulating client data during a session restart, an attacker can obtain an access token th...

7.1CVSS5.8AI score0.00344EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/19 11:1 a.m.26 views

EUVD-2026-30889

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...

7.5CVSS5.8AI score0.00568EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/19 9:19 a.m.26 views

EUVD-2026-30858

Server-Side Request Forgery SSRF vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...

7.3CVSS5.8AI score0.00473EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/19 12:4 a.m.26 views

EUVD-2026-30815

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4,...

5.3CVSS5.8AI score0.00233EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/19 12:0 a.m.26 views

EUVD-2026-30950

An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter...

6.1AI score0.01622EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/05/18 5:3 p.m.26 views

EUVD-2026-30787

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00494EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/18 9:36 a.m.26 views

EUVD-2026-30763

Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity...

6.8CVSS5.8AI score0.00138EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/18 8:37 a.m.26 views

EUVD-2026-30754

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in...

8.7CVSS5.8AI score0.00301EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/18 6:51 a.m.26 views

EUVD-2026-30737

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...

6.5CVSS5.8AI score0.0024EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/18 12:31 a.m.26 views

EUVD-2026-30710

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILOCONFIGCONTENT can lead to information disclosure. It is...

5.3CVSS5.4AI score0.00316EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/05/17 5:51 p.m.26 views

EUVD-2026-30706

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics...

5.8AI score0.00344EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/05/17 11:30 a.m.26 views

EUVD-2026-30697

A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The...

7.5CVSS6.7AI score0.00409EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/17 3:30 a.m.26 views

EUVD-2026-30679

A vulnerability was detected in Open5GS up to 2.7.7. This affects an unknown function in the library /lib/sbi/message.c of the component NRF. Performing a manipulation of the argument service-names/snssais results in denial of service. The attack is possible to be carried out remotely. The exploi...

5.3CVSS5.5AI score0.0039EPSS
SaveExploits1References6
EUVD
EUVD
added 2026/05/15 8:40 p.m.26 views

EUVD-2026-30636

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability. This vulnerability is fixed in 0.9.5...

8.5CVSS5.8AI score0.00292EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/05/15 8:33 p.m.26 views

EUVD-2026-30630

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses modelconfig = ConfigDictextra='allow'. Due to an...

5.4CVSS5.9AI score0.00307EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/05/15 7:34 p.m.26 views

EUVD-2026-30619

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the isuserchannelmember function checks whether a ChannelMember row exists but does not check the isactive field. When a user is deactivated from a group or DM channel removed by the...

5.4CVSS5.8AI score0.00178EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/05/15 6:36 p.m.26 views

EUVD-2026-30602

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solutionidid.html endpoint. Attackers can sequentially...

7.5CVSS5.8AI score0.00259EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/05/15 11:6 a.m.26 views

EUVD-2026-30536

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand function, the epoch time, and the PID, that is hashed...

9.1CVSS5.8AI score0.00583EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/05/15 3:6 a.m.26 views

EUVD-2025-209882

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation...

7.3CVSS5.8AI score0.00276EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/05/15 1:11 a.m.26 views

EUVD-2026-30495

WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution. With no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without...

5.3CVSS6.1AI score0.00127EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/05/14 9:2 p.m.26 views

EUVD-2026-30488

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification POST /v0/auth/http, POST /v0.1/auth/http uses safeDialContext internal/api/handlers/v0/auth/http.go:67-110 to refuse dialling...

6.3CVSS5.9AI score0.00285EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/05/14 4:8 p.m.26 views

EUVD-2026-30324

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show...

10CVSS6.1AI score0.91522EPSS
SaveExploits4References2
EUVD
EUVD
added 2026/05/14 1:8 p.m.26 views

EUVD-2026-28798

Absinthe: Unbounded atom creation from parsed directive name...

8.2CVSS5.8AI score0.00613EPSS
SaveExploits1References5
Total number of security vulnerabilities5000