469504 matches found
EUVD-2026-109228
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...
EUVD-2026-109225
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...
EUVD-2026-109214
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...
EUVD-2026-109217
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...
EUVD-2026-109230
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and...
EUVD-2026-109215
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...
EUVD-2026-109227
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, ...
EUVD-2026-109223
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...
EUVD-2026-109222
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public draft, pending, private and...
EUVD-2026-109221
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...
EUVD-2026-109218
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...
EUVD-2026-109216
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
EUVD-2026-109224
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...
EUVD-2026-109226
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manag...
EUVD-2026-109213
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...
EUVD-2026-109212
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...
EUVD-2026-109231
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...
EUVD-2026-109229
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...
EUVD-2026-109220
A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument basemodelnameorpath causes inclusion of functionality from untrusted control sphere. Th...
EUVD-2026-109219
BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with...
EUVD-2026-109207
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads...
EUVD-2026-109191
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...
EUVD-2026-109205
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...
EUVD-2026-109206
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...
EUVD-2026-109192
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...
EUVD-2026-109208
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1...
EUVD-2026-105028
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory name...
EUVD-2026-105259
virtualenv: Temporary app-data can leave dangling seed package links...
EUVD-2026-105298
virtualenv: Pip seeding with download omits wheel digest verification...
EUVD-2026-105260
virtualenv: Downloaded wheel selection and caching precede verification...
EUVD-2026-105299
virtualenv: Xonsh activation literals depend on the script decoding codec...
EUVD-2026-105302
virtualenv: Seeded files retain permissions from an older cache...
EUVD-2026-105271
virtualenv: Bash prompt values can change meaning under older compatibility modes...
EUVD-2026-105301
virtualenv: Venv configuration readback can reinterpret path boundaries...
EUVD-2026-105300
virtualenv: Seed replacement does not contain metadata deletion paths...
EUVD-2026-102952
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint...
EUVD-2026-102240
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings...
EUVD-2026-102249
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser...
EUVD-2026-102305
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens...
EUVD-2026-108188
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown...
EUVD-2026-105015
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse...
EUVD-2026-105020
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory...
EUVD-2026-105031
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files...
EUVD-2026-104634
Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution...
EUVD-2026-107575
Pillow: Arrow export leaks stale heap memory when PILLOWALIGNMENT 1...
EUVD-2026-107583
Laravel TokenGuard authentication bypass through non-string API credentials...
EUVD-2026-107582
Laravel relationship inclusion can trigger unauthorized data destruction...
EUVD-2026-104814
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding...