EUVD-2026-104865

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the...

EUVD-2026-104863

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

EUVD-2026-104862

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...

EUVD-2026-104861

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

EUVD-2026-104860

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...

EUVD-2026-104859

A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service...

EUVD-2026-104858

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...

EUVD-2026-104857

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes...

EUVD-2026-104856

A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...

EUVD-2026-104855

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

EUVD-2026-104854

A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash...

EUVD-2026-104853

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system...

EUVD-2026-104852

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...

EUVD-2026-104851

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

EUVD-2026-104850

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data...

EUVD-2026-104849

A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service...

EUVD-2026-104848

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled...

EUVD-2026-104847

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution...

EUVD-2026-104846

A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism...

EUVD-2026-104845

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism...

EUVD-2026-104844

An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service...

EUVD-2026-104843

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpcrxfsm function when msglen is set to 0...

EUVD-2026-104842

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpcrxfsm function...

EUVD-2026-104841

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

EUVD-2026-104840

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the ondisconnected callback function...

EUVD-2026-104839

A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service...

EUVD-2026-104838

A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read...

EUVD-2026-104837

A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution...

EUVD-2026-104836

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

EUVD-2026-104835

A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution...

EUVD-2026-104834

Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the...

EUVD-2026-104833

Stored Cross-Site Scripting XSS in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

EUVD-2026-104832

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into...

EUVD-2026-104831

A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges...

EUVD-2026-104830

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently...

EUVD-2026-104829

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution...

EUVD-2024-55809

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...

EUVD-2026-104828

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS...

EUVD-2026-104827

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

EUVD-2026-104826

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

EUVD-2026-104825

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

EUVD-2026-104824

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

EUVD-2026-104807

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

EUVD-2026-104815

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server...

EUVD-2026-104814

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...

EUVD-2026-104813

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

EUVD-2026-104812

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...

EUVD-2026-104811

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-104810

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...

EUVD-2026-104809

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory...