EUVD-2022-5776

Malicious code in bioql PyPI...

EUVD-2021-9017

Malicious code in bioql PyPI...

EUVD-2025-22482

Malicious code in bioql PyPI...

EUVD-2025-22806

Malicious code in bioql PyPI...

EUVD-2025-8869

Malicious code in bioql PyPI...

EUVD-2025-22988

Malicious code in bioql PyPI...

EUVD-2022-32116

Malicious code in bioql PyPI...

EUVD-2024-0083

Malicious code in bioql PyPI...

EUVD-2023-31224

Malicious code in bioql PyPI...

EUVD-2022-2781

Malicious code in bioql PyPI...

EUVD-2023-2788

Malicious code in bioql PyPI...

EUVD-2025-14255

Malicious code in bioql PyPI...

EUVD-2023-33735

Malicious code in bioql PyPI...

EUVD-2024-54719

Malicious code in bioql PyPI...

EUVD-2024-0657

Malicious code in bioql PyPI...

EUVD-2022-5742

Malicious code in bioql PyPI...

EUVD-2022-30389

Malicious code in bioql PyPI...

EUVD-2022-31814

Malicious code in bioql PyPI...

EUVD-2025-27500

Malicious code in bioql PyPI...

EUVD-2025-8615

Malicious code in bioql PyPI...

EUVD-2025-2387

Malicious code in bioql PyPI...

EUVD-2023-0383

Malicious code in bioql PyPI...

EUVD-2023-36924

Malicious code in bioql PyPI...

EUVD-2025-24673

Malicious code in bioql PyPI...

EUVD-2022-44379

Malicious code in bioql PyPI...

EUVD-2024-49694

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 Configuration modules allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before...

EUVD-2026-97124

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

EUVD-2026-95889

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

EUVD-2026-91893

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

EUVD-2026-91587

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-86027

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-79656

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web General. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access...

EUVD-2026-75571

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

EUVD-2026-75326

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...

EUVD-2026-74431

UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-73805

Integer underflow wrap or wraparound in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network...

EUVD-2026-73799

Use after free in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over a network...

EUVD-2026-73797

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

EUVD-2026-73130

Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network...

EUVD-2026-72922

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

EUVD-2026-69734

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-69000

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-67894

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-65195

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

EUVD-2026-64734

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used...