EUVD-2026-110538

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...

EUVD-2026-110537

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/addfood.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may b...

EUVD-2026-110536

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...

EUVD-2026-110535

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...

EUVD-2026-110534

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension chec...

EUVD-2026-110533

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/tag/duplicate, storing local...

EUVD-2026-110532

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

EUVD-2026-110531

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

EUVD-2026-110530

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue falls back to unsanitized $REQUEST values...

EUVD-2026-110529

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste...

EUVD-2026-110528

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries...

EUVD-2026-110527

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL...

EUVD-2026-110526

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens,...

EUVD-2026-110525

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count...

EUVD-2026-110524

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...

EUVD-2026-110523

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...

EUVD-2026-110522

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTPHOST and...

EUVD-2026-110521

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDa...

EUVD-2026-110520

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into...

EUVD-2026-110519

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary...

EUVD-2026-110517

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types,...

EUVD-2026-110518

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant...

EUVD-2026-110516

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to...

EUVD-2026-110515

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...

EUVD-2026-110514

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

EUVD-2026-110513

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

EUVD-2026-110512

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

EUVD-2026-110511

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

EUVD-2026-110510

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

EUVD-2026-110508

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

EUVD-2026-110509

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning clas...

EUVD-2026-110507

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument imagename results in path traversal. The attack is possible to be carried out remotely. The exploit is now...

EUVD-2026-110503

A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The...

EUVD-2026-110502

A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the...

EUVD-2026-110501

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

EUVD-2026-110500

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubel...

EUVD-2026-110499

A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...

EUVD-2026-110498

A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed...

EUVD-2026-110497

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

EUVD-2026-110496

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

EUVD-2026-110495

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMYSECRET fallback key. When KENERSECRETKEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to...

EUVD-2026-110494

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

EUVD-2026-110493

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

EUVD-2026-110491

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecfurlvaluesreaddata that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknownoffset...

EUVD-2026-110492

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

EUVD-2026-110490

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzfindexloadhfile in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc0 buffer and an...

EUVD-2026-110489

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

EUVD-2026-110488

libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mqparsemediaquery that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or othe...

EUVD-2026-110487

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

EUVD-2026-110486

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...