EUVD-2026-26220

A missing permission check in Jenkins Script Security Plugin 1399.ve6a66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths...

EUVD-2020-14257

Malware in sbrugna...

EUVD-2019-7182

Malware in sbrugna...

EUVD-2024-46940

Malicious code in bioql PyPI...

EUVD-2024-51984

Malicious code in bioql PyPI...

EUVD-2025-24957

Malicious code in bioql PyPI...

EUVD-2025-18398

Malicious code in bioql PyPI...

EUVD-2025-13640

Malicious code in bioql PyPI...

EUVD-2023-33852

Malicious code in bioql PyPI...

EUVD-2025-29700

Malicious code in bioql PyPI...

EUVD-2023-34498

Malicious code in bioql PyPI...

EUVD-2024-46736

Malicious code in bioql PyPI...

EUVD-2023-29021

Malicious code in bioql PyPI...

EUVD-2026-56398

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally...

EUVD-2026-47060

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

EUVD-2026-35549

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability...

EUVD-2026-32445

In the Linux kernel, the following vulnerability has been resolved: x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow...

EUVD-2026-31433

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

EUVD-2026-30618

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the type: "file" non-full-context, type: "text" with collectionname, and bare collectionname/collectionnames paths in the getsourcesfromitems function perform vector store queries...

EUVD-2026-30349

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps quer...

EUVD-2026-29930

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances...

EUVD-2026-29685

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

EUVD-2026-29379

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

EUVD-2021-34808

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during paymen...

EUVD-2026-28422

The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp". An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink...

EUVD-2026-28342

Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link...

EUVD-2026-26928

A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a manipulation of the argument fid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be us...

EUVD-2026-14881

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names...

EUVD-2026-8643

Basic FTP has Path Traversal Vulnerability in its downloadToDir method...

EUVD-2021-20812

Malware in sbrugna...

EUVD-2007-0051

Malware in sbrugna...

EUVD-2023-54478

Malicious code in bioql PyPI...

EUVD-2025-16578

Malicious code in bioql PyPI...

EUVD-2024-54366

Malicious code in bioql PyPI...

EUVD-2022-41048

Malicious code in bioql PyPI...

EUVD-2024-29282

Malicious code in bioql PyPI...

EUVD-2025-29241

Malicious code in bioql PyPI...

EUVD-2025-9242

Malicious code in bioql PyPI...

EUVD-2024-27276

Malicious code in bioql PyPI...

EUVD-2024-27363

Malicious code in bioql PyPI...

EUVD-2025-22226

Malicious code in bioql PyPI...

EUVD-2025-31641

Malicious code in bioql PyPI...

EUVD-2026-45449

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

EUVD-2024-55662

HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated...

EUVD-2026-42129

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean for example the string...

EUVD-2026-39219

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrackirc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given...

EUVD-2026-35667

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-35301

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled tpf POST parameter before it is used in an include path in the recoverexit function...

EUVD-2026-33073

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for or the configured IP-bearing header. IPv6 clients controlling a typical /6...

EUVD-2026-31942

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting XSS via attachment filenames in remediation verification file preview flows. User-supplied filename values are persisted and then rendered into HTML and...