EUVD-2026-64840

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

EUVD-2026-64838

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirmorder. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has be...

EUVD-2026-64829

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

EUVD-2026-64835

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

EUVD-2026-64785

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-64784

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

EUVD-2026-64786

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64787

Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...

EUVD-2026-64788

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

EUVD-2026-64836

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64826

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

EUVD-2026-64831

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

EUVD-2026-64834

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

EUVD-2026-64795

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

EUVD-2026-64796

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

EUVD-2026-64798

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

EUVD-2026-64801

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

EUVD-2026-64803

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

EUVD-2026-64804

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

EUVD-2026-64808

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

EUVD-2026-64810

Unauthenticated Local File Inclusion in Måne = 1.7 versions...

EUVD-2026-64809

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

EUVD-2026-64827

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

EUVD-2026-64833

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

EUVD-2026-64828

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

EUVD-2026-64789

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

EUVD-2026-64792

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

EUVD-2026-64793

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

EUVD-2026-64800

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

EUVD-2026-64802

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

EUVD-2026-64794

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

EUVD-2026-64832

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

EUVD-2026-64799

Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...

EUVD-2026-64807

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

EUVD-2026-64806

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64805

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

EUVD-2026-64761

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution...

EUVD-2026-64762

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution...

EUVD-2026-64824

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. T...

EUVD-2025-210761

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

EUVD-2026-64790

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

EUVD-2026-64791

Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...

EUVD-2026-64775

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

EUVD-2026-64759

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution...

EUVD-2026-64774

Micrometer-instrumented Apache HttpAsyncClient 4.x or 5.x usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response e.g. connection resets or timeouts. Tracking state for these requests remains in memory indefinitely, and...

EUVD-2026-64776

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...