Lucene search
+L

452134 matches found

EUVD
EUVD
•added 2026/09/17 1:46 p.m.•17 views

EUVD-2026-81592

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

8.7CVSS5.7AI score0.00488EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•12 views

EUVD-2026-81591

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

10CVSS8.1AI score0.00289EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•13 views

EUVD-2026-81590

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require'https'. The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on are forwarded to the...

10CVSS8.2AI score0.00474EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•9 views

EUVD-2026-81589

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

9.9CVSS8.7AI score0.00616EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•15 views

EUVD-2026-81588

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

9.9CVSS8.6AI score0.00616EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•11 views

EUVD-2026-81587

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...

10CVSS8.9AI score0.01033EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•14 views

EUVD-2026-81586

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

6.9CVSS5.9AI score0.00455EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•11 views

EUVD-2026-81584

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

9.5CVSS8.5AI score0.00762EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:46 p.m.•11 views

EUVD-2026-81585

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

9.5CVSS6.2AI score0.00673EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/17 1:45 p.m.•11 views

EUVD-2026-81583

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...

6.9CVSS5.9AI score0.00372EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/17 1:43 p.m.•10 views

EUVD-2026-81582

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

6.1CVSS6.1AI score0.00393EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/17 1:43 p.m.•10 views

EUVD-2026-81581

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

8.8CVSS5.9AI score0.00468EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/17 1:43 p.m.•10 views

EUVD-2026-81580

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...

8.7CVSS5.8AI score0.00704EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/17 1:43 p.m.•9 views

EUVD-2026-81579

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

8.8CVSS6.2AI score0.0082EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/09/17 1:40 p.m.•13 views

EUVD-2026-81578

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

5.4CVSS6AI score0.00205EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:27 p.m.•14 views

EUVD-2026-81523

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

8.7CVSS5.8AI score0.00277EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:26 p.m.•13 views

EUVD-2026-81522

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

8.8CVSS5.9AI score0.00295EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•11 views

EUVD-2026-81521

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

7.1CVSS5.7AI score0.00251EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•9 views

EUVD-2026-81520

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

5.3CVSS5.7AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81519

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

8.8CVSS5.7AI score0.00201EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81518

Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•14 views

EUVD-2026-81517

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

5.3CVSS5.7AI score0.00313EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•8 views

EUVD-2026-81516

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

5.4CVSS5.7AI score0.00138EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•16 views

EUVD-2026-81515

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

5.3CVSS5.7AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•9 views

EUVD-2026-81513

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

5.4CVSS5.7AI score0.00287EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81514

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

5.3CVSS5.7AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•11 views

EUVD-2026-81512

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

5.3CVSS5.7AI score0.00313EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81511

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•14 views

EUVD-2026-81510

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•17 views

EUVD-2026-81509

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•10 views

EUVD-2026-81507

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•16 views

EUVD-2026-81508

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•15 views

EUVD-2026-81506

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•11 views

EUVD-2026-81505

Administrator SQL Injection in Newsletters = 4.18 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•15 views

EUVD-2026-81504

Administrator SQL Injection in WP Maps = 4.9.9 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81503

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•10 views

EUVD-2026-81502

Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...

6.4CVSS5.8AI score0.0023EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81501

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

8.5CVSS5.8AI score0.00357EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81500

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•10 views

EUVD-2026-81499

Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81498

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81496

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

5.3CVSS5.7AI score0.00294EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81497

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•11 views

EUVD-2026-81495

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•9 views

EUVD-2026-81493

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81494

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•12 views

EUVD-2026-81492

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

7.1CVSS5.7AI score0.00128EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•13 views

EUVD-2026-81491

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

9.8CVSS5.7AI score0.00606EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•11 views

EUVD-2026-81490

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

10CVSS5.8AI score0.0086EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/17 1:24 p.m.•16 views

EUVD-2026-81489

Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...

9.8CVSS5.7AI score0.00606EPSS
SaveExploits0References1
Total number of security vulnerabilities452134