EUVD-2026-105150

The Module Manager's block-pool create dispatcher proved that two ALIGNTYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...

EUVD-2026-105149

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...

EUVD-2026-105147

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended...

EUVD-2026-105146

A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...

EUVD-2026-105145

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

EUVD-2026-105144

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txmmoduleobjectdeallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is...

EUVD-2026-105142

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

EUVD-2026-105141

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

EUVD-2026-105140

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

EUVD-2026-105139

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7...

EUVD-2026-105138

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30...

EUVD-2026-105137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

EUVD-2026-105136

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

EUVD-2026-105134

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

EUVD-2026-105133

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

EUVD-2026-105132

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

EUVD-2026-105131

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105129

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the NXCRYPTOMAXRSAMODULUSSIZE default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope...

EUVD-2026-105127

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

EUVD-2026-105126

gxmultilinetextviewdisplayinfoget reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return \r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in...

EUVD-2026-105046

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating...

EUVD-2026-105045

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...

EUVD-2026-105044

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

EUVD-2026-105043

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

EUVD-2026-105042

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...

EUVD-2026-105041

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

EUVD-2026-105040

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

EUVD-2026-105039

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

EUVD-2026-105038

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

EUVD-2026-105037

gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...

EUVD-2026-105036

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...

EUVD-2026-105035

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

EUVD-2026-105034

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...

EUVD-2026-105033

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

EUVD-2026-105032

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the...

EUVD-2026-105031

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

EUVD-2026-105030

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

EUVD-2026-105029

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

EUVD-2026-105028

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...

EUVD-2026-104537

Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths...

EUVD-2026-105027

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

EUVD-2026-104538

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes...

EUVD-2026-105026

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory t...

EUVD-2026-88977

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress...

EUVD-2026-105025

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

EUVD-2026-105024

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

EUVD-2026-105023

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

EUVD-2026-105022

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

EUVD-2026-105021

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...