EUVD-2024-3184

Malicious code in bioql PyPI...

EUVD-2025-22806

Malicious code in bioql PyPI...

EUVD-2023-12128

Malicious code in bioql PyPI...

EUVD-2024-43807

Malicious code in bioql PyPI...

EUVD-2025-24673

Malicious code in bioql PyPI...

EUVD-2021-29309

Malicious code in bioql PyPI...

EUVD-2024-38363

Malicious code in bioql PyPI...

EUVD-2023-0631

Malicious code in bioql PyPI...

EUVD-2021-28411

Malicious code in bioql PyPI...

EUVD-2023-56052

Malicious code in bioql PyPI...

EUVD-2025-18618

Malicious code in bioql PyPI...

EUVD-2025-24185

Malicious code in bioql PyPI...

EUVD-2022-5591

Malicious code in bioql PyPI...

EUVD-2023-29972

Malicious code in bioql PyPI...

EUVD-2025-28551

Malicious code in bioql PyPI...

EUVD-2023-54464

Malicious code in bioql PyPI...

EUVD-2025-24107

Malicious code in bioql PyPI...

EUVD-2024-2500

Malicious code in bioql PyPI...

EUVD-2024-36691

Malicious code in bioql PyPI...

EUVD-2025-23667

Malicious code in bioql PyPI...

EUVD-2024-36132

Malicious code in bioql PyPI...

EUVD-2025-12565

Malicious code in bioql PyPI...

EUVD-2025-1529

Malicious code in bioql PyPI...

EUVD-2022-6293

Malicious code in bioql PyPI...

EUVD-2022-26934

Malicious code in bioql PyPI...

EUVD-2022-6785

Malicious code in bioql PyPI...

EUVD-2025-17441

Malicious code in bioql PyPI...

EUVD-2024-52186

Malicious code in bioql PyPI...

EUVD-2022-31382

.NET Framework Denial of Service Vulnerability...

EUVD-2026-43179

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats...

EUVD-2026-92262

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

EUVD-2026-92077

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

EUVD-2026-91893

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

EUVD-2026-91587

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-77317

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible...

EUVD-2026-42963

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider...

EUVD-2026-73805

Integer underflow wrap or wraparound in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network...

EUVD-2026-72982

Out-of-bounds read in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

EUVD-2026-72922

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

EUVD-2026-57410

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy...

EUVD-2026-68141

qs array-limit bypass via bracket-key comma parsing...

EUVD-2026-69736

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-69579

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...

EUVD-2026-45030

Whistle vulnerable to path traversal...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

EUVD-2026-63088

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

EUVD-2026-62734

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

EUVD-2026-62587

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

EUVD-2026-61099

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...