EUVD-2026-81583

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...

EUVD-2026-81582

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

EUVD-2026-81581

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

EUVD-2026-81580

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...

EUVD-2026-81579

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen pat...

EUVD-2026-81578

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

EUVD-2026-81523

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

EUVD-2026-81522

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

EUVD-2026-81521

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

EUVD-2026-81520

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

EUVD-2026-81519

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

EUVD-2026-81518

Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...

EUVD-2026-81517

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

EUVD-2026-81516

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

EUVD-2026-81515

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

EUVD-2026-81513

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

EUVD-2026-81514

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

EUVD-2026-81512

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

EUVD-2026-81511

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

EUVD-2026-81510

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

EUVD-2026-81509

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

EUVD-2026-81507

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

EUVD-2026-81508

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

EUVD-2026-81506

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

EUVD-2026-81505

Administrator SQL Injection in Newsletters = 4.18 versions...

EUVD-2026-81504

Administrator SQL Injection in WP Maps = 4.9.9 versions...

EUVD-2026-81503

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

EUVD-2026-81502

Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...

EUVD-2026-81501

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

EUVD-2026-81500

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...

EUVD-2026-81499

Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...

EUVD-2026-81498

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

EUVD-2026-81496

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

EUVD-2026-81497

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

EUVD-2026-81495

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

EUVD-2026-81493

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

EUVD-2026-81494

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

EUVD-2026-81492

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

EUVD-2026-81491

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

EUVD-2026-81490

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

EUVD-2026-81489

Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...

EUVD-2026-81488

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

EUVD-2026-81487

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

EUVD-2026-81486

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with sessionidentifier :jti and requiretokenpresenceforauthentication? disabled stores its session value as :...

EUVD-2026-81485

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

EUVD-2026-81484

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

EUVD-2026-81483

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

EUVD-2026-81482

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

EUVD-2026-81481

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

EUVD-2026-81480

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...