EUVD-2026-88484

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

EUVD-2026-76142

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS...

EUVD-2026-68961

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution...

EUVD-2026-65088

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution SSRF still present in InetAddress deserialization...

EUVD-2026-88483

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

EUVD-2026-88482

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09...

EUVD-2026-88481

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...

EUVD-2026-88480

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

EUVD-2026-88479

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

EUVD-2026-88478

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

EUVD-2026-88477

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

EUVD-2026-88476

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

EUVD-2026-88475

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

EUVD-2026-88474

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

EUVD-2026-88473

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...

EUVD-2026-88472

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffersize field of struct adcsequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the...

EUVD-2026-88471

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffersize field of struct adcsequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the...

EUVD-2026-88470

The userspace verifier zvrfyrtiosqecopyingethandles in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed handle = sqe, storing the kernel address ...

EUVD-2026-88469

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

EUVD-2026-88468

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

EUVD-2026-88467

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

EUVD-2026-88466

A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched...

EUVD-2026-88464

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

EUVD-2026-88463

A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been...

EUVD-2026-88462

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

EUVD-2026-88446

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The...

EUVD-2026-88445

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have...

EUVD-2026-88444

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

EUVD-2026-88443

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

EUVD-2026-88442

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

EUVD-2026-88441

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. Chromium security severity: Low...

EUVD-2026-88440

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09. Security Researcher: Zhi Yang Bingren Wu Findin...

EUVD-2026-88439

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...

EUVD-2026-88438

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

EUVD-2026-88437

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

EUVD-2026-88436

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

EUVD-2026-88434

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

EUVD-2026-88433

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carrie...

EUVD-2026-88432

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

EUVD-2026-88404

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2BAPIKEY leads to reliance on untrusted inputs in a security decision. Local access is...

EUVD-2026-88403

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

EUVD-2026-88402

A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...

EUVD-2026-88401

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

EUVD-2026-88400

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-88399

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

EUVD-2026-88398

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

EUVD-2026-88397

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

EUVD-2026-88396

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...