EUVD-2026-117877

AG2: Newline injection in SandboxShellTool bypasses allowed=... and readonly=True, enabling arbitrary command execution...

EUVD-2026-117125

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover...

EUVD-2026-118389

Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API...

EUVD-2026-120156

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output...

EUVD-2026-120128

compose-lint: A .compose-lint.yml symlinked outside the project is read, and a parse error quotes part of the target...

EUVD-2026-120129

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated .env into its findings...

EUVD-2026-120127

compose-lint: fix --apply can delete a line the user did not select, including a security setting...

EUVD-2026-120126

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action...

EUVD-2026-120123

compose-lint: .env read through a symlink outside the project can expose the CI job's environment...

EUVD-2026-117556

Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks...

EUVD-2026-116210

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound DefaultRolePermissions...

EUVD-2026-114192

gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments...

EUVD-2026-117876

Dagu MCP DAG specification read bypasses path containment and workspace isolation...

EUVD-2026-121272

In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura...

EUVD-2026-121271

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root...

EUVD-2026-121270

A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges...

EUVD-2026-121269

An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service...

EUVD-2026-121268

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

EUVD-2026-121267

Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries...

EUVD-2026-121266

An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's...

EUVD-2026-121265

OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

EUVD-2026-121264

Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts an...

EUVD-2026-121263

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity...

EUVD-2026-121262

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue...

EUVD-2026-121163

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

EUVD-2026-121162

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation...

EUVD-2026-121161

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or...

EUVD-2026-121160

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade t...

EUVD-2026-121159

Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access...

EUVD-2026-121158

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

EUVD-2026-121157

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

EUVD-2026-121156

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

EUVD-2026-121155

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries...

EUVD-2026-121261

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

EUVD-2026-121260

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...

EUVD-2026-121259

Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access...

EUVD-2026-121258

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. On...

EUVD-2026-121257

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

EUVD-2026-121256

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged...

EUVD-2026-121255

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user...

EUVD-2026-121254

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic...

EUVD-2026-121253

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

EUVD-2026-121252

A out-of-bounds read vulnerability exists in the drmp3 drmp3initinternal functionality of drlibs versions: 0.7.3. A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...

EUVD-2026-121251

A out-of-bounds write vulnerability exists in the drwav drwavreadcuetometadataobj functionality of drlibs versions: 0.14.5. A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

EUVD-2026-121250

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...

EUVD-2026-121249

A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...

EUVD-2026-121248

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution...

EUVD-2026-121247

When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...

EUVD-2026-121246

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token...

EUVD-2026-121245

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...