EUVD-2026-65304

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...

EUVD-2026-65310

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65309

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65308

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

EUVD-2026-65307

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has th...

EUVD-2026-65306

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

EUVD-2026-65305

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

EUVD-2026-65300

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

EUVD-2026-65298

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

EUVD-2026-65303

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...

EUVD-2026-65302

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

EUVD-2026-65301

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

EUVD-2026-65293

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

EUVD-2026-65292

The Zephyr ext2 filesystem driver fails to validate the slogblocksize field of the on-disk superblock when mounting a filesystem. ext2verifydisksuperblock in subsys/fs/ext2/ext2impl.c checks the magic number, revision, inode size and group counts, but never bounds slogblocksize. On a successful...

EUVD-2026-65291

The OCPP 1.6 client in subsys/net/lib/ocpp/ocppj.c contains a stack buffer overflow in parsegetconfigmsg. When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer skeyCISTR50, declar...

EUVD-2026-65290

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...

EUVD-2026-65278

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

EUVD-2026-65279

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65276

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65277

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65274

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

EUVD-2026-65275

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

EUVD-2026-65273

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

EUVD-2026-65271

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

EUVD-2025-210770

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

EUVD-2026-65270

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

EUVD-2026-65229

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

EUVD-2026-65228

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

EUVD-2026-65227

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

EUVD-2026-65226

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

EUVD-2026-65225

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

EUVD-2026-65224

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

EUVD-2026-65223

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

EUVD-2026-65222

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

EUVD-2026-65221

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

EUVD-2026-65220

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

EUVD-2026-65219

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

EUVD-2026-65218

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

EUVD-2026-65217

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

EUVD-2026-65216

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer and Pages::referrerRoute methods, which validate the Referer header using an unanchored string prefix match strstartswith$referrer, $base with no trailing delimiter. An attacker who controls a domain that begins with...

EUVD-2026-65215

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...

EUVD-2026-65214

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

EUVD-2026-65212

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

EUVD-2026-65213

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

EUVD-2026-65211

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...

EUVD-2026-65210

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

EUVD-2026-65208

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

EUVD-2026-65209

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...