EUVD-2026-52574

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

EUVD-2026-52573

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

EUVD-2026-52572

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

EUVD-2026-52571

A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched...

EUVD-2026-52570

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

EUVD-2026-52569

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

EUVD-2026-52568

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

EUVD-2026-52567

An improper authentication vulnerability in the "sociallogin.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an attacker on the WLAN to bypass captive portal authentication...

EUVD-2026-52566

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

EUVD-2026-52565

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

EUVD-2026-52554

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

EUVD-2026-52564

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

EUVD-2026-52553

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

EUVD-2026-52561

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

EUVD-2026-52562

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

EUVD-2026-52563

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

EUVD-2026-52560

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

EUVD-2026-52534

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-52526

Time-of-check time-of-use toctou race condition in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

EUVD-2026-52522

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52528

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-52532

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

EUVD-2026-52533

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-52527

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52521

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

EUVD-2026-52535

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52505

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via transmitting a crafted SBN frame...

EUVD-2026-52529

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

EUVD-2026-52525

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

EUVD-2026-52537

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function setupgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

EUVD-2026-52523

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

EUVD-2026-52524

Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

EUVD-2026-52518

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction...

EUVD-2026-52536

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

EUVD-2026-52530

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-52531

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

EUVD-2026-52514

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

EUVD-2026-52516

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

EUVD-2026-52506

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

EUVD-2026-52515

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL...

EUVD-2026-52511

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

EUVD-2026-52490

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

EUVD-2026-52508

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

EUVD-2026-52513

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

EUVD-2026-52517

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

EUVD-2026-52520

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

EUVD-2026-52507

Incorrect access control in the DSSetDestPathCmd component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal...

EUVD-2026-52509

An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-52519

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation o...

EUVD-2026-52452

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...