EUVD-2026-81601

vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...

EUVD-2026-81597

vm2: NodeVM builtin allowlist bypass via node:test.run execArgv allows sandbox escape...

EUVD-2026-81599

vm2 CLI provides no sandbox isolation - host-realm require is reachable from sandboxed scripts...

EUVD-2026-81590

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent...

EUVD-2026-81600

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

EUVD-2026-90883

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

EUVD-2026-81606

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes childprocess...

EUVD-2026-81598

vm2: vm.freeze/vm.readonly bypass via accessor descriptor...

EUVD-2026-81585

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE...

EUVD-2026-81587

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection...

EUVD-2026-90841

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

EUVD-2026-90836

Unauthenticated Insecure Direct Object References IDOR in WPFunnels = 3.13.1 versions...

EUVD-2026-90838

Subscriber Broken Access Control in Social Boost = 3.6.2 versions...

EUVD-2026-90835

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

EUVD-2026-90873

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

EUVD-2026-90840

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

EUVD-2026-90837

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

EUVD-2026-90839

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

EUVD-2026-90858

Unauthenticated Cross Site Scripting XSS in MaxGalleria = 6.5.3 versions...

EUVD-2026-90877

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...

EUVD-2026-90874

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

EUVD-2026-90856

Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...

EUVD-2026-90851

Unauthenticated Privilege Escalation in Authorizer = 3.15.3 versions...

EUVD-2026-90850

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

EUVD-2026-90876

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

EUVD-2026-90857

Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...

EUVD-2026-90855

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

EUVD-2026-90854

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

EUVD-2026-90852

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

EUVD-2026-90853

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

EUVD-2026-90879

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...

EUVD-2026-90878

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

EUVD-2026-90875

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

EUVD-2026-90871

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

EUVD-2026-90849

boksksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can...

EUVD-2026-90846

Unauthenticated Bypass Vulnerability in hCaptcha for WP = 5.3.0 versions...

EUVD-2026-90845

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

EUVD-2026-90847

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-90843

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

EUVD-2026-90842

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

EUVD-2026-90817

iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim...

EUVD-2026-90815

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

EUVD-2026-90806

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...

EUVD-2026-90848

In deployments using BoKS keytab management, affected versions of bokskeytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change tim...

EUVD-2026-90807

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2...

EUVD-2026-90844

Unauthenticated Cross Site Scripting XSS in Parallax Section block = 2.0.4 versions...

EUVD-2026-90816

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...

EUVD-2026-90814

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

EUVD-2026-90813

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...