Lucene search
+L

452462 matches found

EUVD
EUVD
•added 2026/09/18 1:26 a.m.•16 views

EUVD-2026-82620

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

4.3CVSS5.6AI score0.0027EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 1:26 a.m.•16 views

EUVD-2026-82623

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

3.1CVSS5.4AI score0.00227EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 1:26 a.m.•16 views

EUVD-2026-82619

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

4.3CVSS5.5AI score0.00329EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 1:26 a.m.•18 views

EUVD-2026-82618

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

6.5CVSS6.5AI score0.00469EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 1:26 a.m.•22 views

EUVD-2026-82621

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

6.2CVSS6.5AI score0.00189EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 1:24 a.m.•17 views

EUVD-2026-82615

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

7.1CVSS5.8AI score0.00454EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 1:24 a.m.•17 views

EUVD-2026-82616

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

8.4CVSS5.6AI score0.00204EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/18 1:15 a.m.•16 views

EUVD-2026-82614

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could ...

7.5CVSS6.2AI score0.00432EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/09/18 12:45 a.m.•17 views

EUVD-2026-82613

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to...

5.3CVSS4.7AI score0.00594EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82606

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

5.4CVSS5.9AI score0.00298EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82609

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

5.3CVSS5AI score0.00521EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•10 views

EUVD-2026-82602

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

8.7CVSS5.9AI score0.00917EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•17 views

EUVD-2026-82600

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

7.7CVSS5.7AI score0.00859EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•16 views

EUVD-2026-82605

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid...

8.7CVSS5.8AI score0.00491EPSS
SaveExploits1References7
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•15 views

EUVD-2026-82601

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

5.3CVSS5AI score0.00521EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•13 views

EUVD-2026-82604

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compressByteBuffer, ByteBuffer that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and...

8.7CVSS6.1AI score0.00681EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82603

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

6.9CVSS6.3AI score0.00503EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•11 views

EUVD-2026-82591

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

9.6CVSS5.8AI score0.00789EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82595

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...

7.8CVSS7.6AI score0.00233EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•15 views

EUVD-2026-82607

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6AI score0.00261EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82608

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

4.3CVSS5.6AI score0.00243EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82533

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

8.7CVSS5.8AI score0.0063EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82534

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

8.7CVSS5.7AI score0.00759EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•13 views

EUVD-2026-82597

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...

9.9CVSS5.8AI score0.00778EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•19 views

EUVD-2026-82599

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Portal allows an unauthorized attacker to perform spoofing over a network...

8.2CVSS5.8AI score0.0032EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82594

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

7.5CVSS5.8AI score0.00973EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•15 views

EUVD-2026-82596

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00428EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82598

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00901EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82587

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

8.6CVSS5.7AI score0.0054EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•12 views

EUVD-2026-82586

Azure Arc Elevation of Privilege Vulnerability...

10CVSS5.7AI score0.00484EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•13 views

EUVD-2026-82582

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

6.1CVSS5.8AI score0.0039EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•15 views

EUVD-2026-82568

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to...

5.3CVSS5AI score0.00533EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82592

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.006EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82589

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00442EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•30 views

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

7.4CVSS5.8AI score0.00893EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82584

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00815EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•19 views

EUVD-2026-82583

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

9.3CVSS5.8AI score0.00534EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•14 views

EUVD-2026-82588

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

9.9CVSS5.8AI score0.0072EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•15 views

EUVD-2026-82585

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

9CVSS5.8AI score0.00372EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•25 views

EUVD-2026-82593

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

10CVSS6AI score0.00671EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•11 views

EUVD-2026-82494

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

5.3CVSS5.8AI score0.00244EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•21 views

EUVD-2026-82495

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

5.3CVSS5.7AI score0.0023EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/18 12:31 a.m.•17 views

EUVD-2026-82496

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

5.4CVSS5.8AI score0.00174EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/18 12:30 a.m.•12 views

EUVD-2026-82612

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed...

5.3CVSS5.1AI score0.00562EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 12:26 a.m.•15 views

EUVD-2026-82611

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand TC receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the...

8.7CVSS5.8AI score0.00564EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:00 a.m.•10 views

EUVD-2026-82610

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was inform...

6.9CVSS5.5AI score0.00701EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 12:00 a.m.•11 views

EUVD-2026-82974

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

5.9AI score0.00499EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:00 a.m.•11 views

EUVD-2026-82975

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...

8.8CVSS5.8AI score0.01086EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/18 12:00 a.m.•12 views

EUVD-2026-82973

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

6.1CVSS6.6AI score0.00506EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/17 10:06 p.m.•12 views

EUVD-2026-82532

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

4.8CVSS5.9AI score0.01081EPSS
SaveExploits2References5
Total number of security vulnerabilities452462