EUVD-2022-32116

Malicious code in bioql PyPI...

EUVD-2024-0083

Malicious code in bioql PyPI...

EUVD-2023-31224

Malicious code in bioql PyPI...

EUVD-2022-2781

Malicious code in bioql PyPI...

EUVD-2023-2788

Malicious code in bioql PyPI...

EUVD-2025-14255

Malicious code in bioql PyPI...

EUVD-2024-0657

Malicious code in bioql PyPI...

EUVD-2022-30389

Malicious code in bioql PyPI...

EUVD-2022-31814

Malicious code in bioql PyPI...

EUVD-2025-27500

Malicious code in bioql PyPI...

EUVD-2025-2387

Malicious code in bioql PyPI...

EUVD-2025-28311

Malicious code in bioql PyPI...

EUVD-2025-19421

Malicious code in bioql PyPI...

EUVD-2022-4627

Malicious code in bioql PyPI...

EUVD-2025-8615

Malicious code in bioql PyPI...

EUVD-2025-23296

Malicious code in bioql PyPI...

EUVD-2023-57531

Malicious code in bioql PyPI...

EUVD-2021-33128

Malicious code in bioql PyPI...

EUVD-2024-0122

Malicious code in bioql PyPI...

EUVD-2025-13496

Malicious code in bioql PyPI...

EUVD-2023-36924

Malicious code in bioql PyPI...

EUVD-2025-22780

Malicious code in bioql PyPI...

EUVD-2022-7575

Malicious code in bioql PyPI...

EUVD-2021-28411

Malicious code in bioql PyPI...

EUVD-2022-28674

Malicious code in bioql PyPI...

EUVD-2024-49694

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 Configuration modules allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before...

EUVD-2026-97124

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

EUVD-2026-43179

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats...

EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

EUVD-2026-91893

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

EUVD-2026-86027

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-79656

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web General. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access...

EUVD-2026-75571

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

EUVD-2026-75326

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINICLIHOME...

EUVD-2026-73805

Integer underflow wrap or wraparound in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network...

EUVD-2026-73799

Use after free in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over a network...

EUVD-2026-73797

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

EUVD-2026-72922

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

EUVD-2026-69734

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-69000

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-67894

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-64734

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63088

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

EUVD-2026-60958

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

EUVD-2026-59778

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...