435544 matches found
EUVD-2026-54096
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
EUVD-2026-54095
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can...
EUVD-2026-54094
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...
EUVD-2026-54093
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are...
EUVD-2026-54092
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...
EUVD-2026-54091
Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...
EUVD-2026-54090
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...
EUVD-2026-54089
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
EUVD-2026-54088
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
EUVD-2026-54087
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...
EUVD-2026-54086
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...
EUVD-2026-54085
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...
EUVD-2026-54084
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...
EUVD-2026-54083
Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...
EUVD-2026-54082
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
EUVD-2026-54081
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...
EUVD-2026-54080
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
EUVD-2026-54079
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
EUVD-2026-54078
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...
EUVD-2026-53920
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
EUVD-2025-210642
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
EUVD-2026-53919
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...
EUVD-2026-53918
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...
EUVD-2026-53917
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
EUVD-2026-53916
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
EUVD-2026-53915
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component getcredentialfromuser. This manipulation of the argument Description causes command injection. It is...
EUVD-2026-53914
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
EUVD-2026-53912
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
EUVD-2026-53913
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
EUVD-2026-53911
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
EUVD-2026-53910
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
EUVD-2026-53909
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
EUVD-2026-53908
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
EUVD-2026-53907
Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...
EUVD-2026-53906
Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...
EUVD-2026-53905
Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...
EUVD-2026-53904
Custom role Broken Access Control in Dokan = 5.0.10 versions...
EUVD-2026-53903
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
EUVD-2026-53902
Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
EUVD-2026-53901
Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...
EUVD-2026-53899
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
EUVD-2026-53898
Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...
EUVD-2026-53897
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
EUVD-2026-53896
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
EUVD-2026-53894
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
EUVD-2026-53895
Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...
EUVD-2026-53893
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...