EUVD-2026-102081

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

EUVD-2026-102057

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...

EUVD-2026-102056

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

EUVD-2026-102055

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

EUVD-2026-102054

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

EUVD-2026-102053

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

EUVD-2026-102052

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7...

EUVD-2026-102047

Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2...

EUVD-2026-102048

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

EUVD-2026-102050

Improper Control of Generation of Code 'Code Injection' vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1...

EUVD-2026-102051

Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13...

EUVD-2026-102049

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8...

EUVD-2026-102046

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31...

EUVD-2026-66584

In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once again before scsiautopmputhost. That is racy when a PM-triggered err...

EUVD-2026-66458

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrbmsgtotype6cprbmsgx and xcrbmsgtotype6ep11cprbmsgx copy the user space message into a kernel buffer based on the message length. But on further...

EUVD-2026-66590

In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in opteeffalendprotmem Sashiko locally reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer. Fix that by adding the missing check...

EUVD-2026-102045

Enterprise Architect is vulnerable to XML External Entity XXE injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's...

EUVD-2026-102044

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksumstart before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skbchecksumhelp can corrupt the network header and cause a bunch of mischief. This was discovered and report...

EUVD-2026-102030

In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...

EUVD-2026-102029

In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...

EUVD-2026-102028

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4...

EUVD-2026-102027

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...

EUVD-2026-102026

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5...

EUVD-2026-102025

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently process a retransmitted SYN for th...

EUVD-2026-102024

A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior...

EUVD-2026-102023

Path Traversal CWE-22 in the executeobj function of the archive object viewer peach.pas in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... - Associated application" action Shift+Ctrl+O to execute an...

EUVD-2026-102022

In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...

EUVD-2026-102021

A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure...

EUVD-2026-102020

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This...

EUVD-2026-102019

A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server...

EUVD-2026-102018

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

EUVD-2026-102009

A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service...

EUVD-2026-102005

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...

EUVD-2026-102007

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5...

EUVD-2026-102006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...

EUVD-2026-102004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1...

EUVD-2026-102008

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...

EUVD-2026-102003

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash...

EUVD-2026-102002

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

EUVD-2026-102001

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

EUVD-2026-102000

Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5...

EUVD-2026-101999

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

EUVD-2026-101998

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow...

EUVD-2026-101997

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow...

EUVD-2026-101996

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

EUVD-2026-101995

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

EUVD-2026-101994

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...

EUVD-2026-101993

An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within...

EUVD-2026-101992

A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow...

EUVD-2026-101991

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...