EUVD-2026-121580

Microsoft Security Advisory CVE-2026-109481 - ASP.NET Core Elevation of Privilege Vulnerability...

EUVD-2026-122256

Microsoft Security Advisory CVE-2026-118750 - ASP.NET Core Denial of Service Vulnerability...

EUVD-2026-122230

Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability...

EUVD-2026-121559

Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability...

EUVD-2026-122469

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability...

EUVD-2026-122253

Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability...

EUVD-2026-122255

Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability...

EUVD-2026-121973

Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability...

EUVD-2026-121560

Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability...

EUVD-2026-123052

React: Unauthenticated Remote Code Execution in React Server Components...

EUVD-2026-123058

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

EUVD-2024-55844

Missing Lock Bit Protection in the Northbridge IO NBIO could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability...

EUVD-2026-123051

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets...

EUVD-2025-211288

Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock SDU, potentially resulting in unauthorized debug access...

EUVD-2025-211287

Operation on a resource after expiration or release in the Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to manipulate metadata pages potentially resulting in the loss of confidentiality and integrity of guest memory...

EUVD-2025-211286

Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys...

EUVD-2026-123050

Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization SEV firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality...

EUVD-2026-123049

Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization SEV firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity...

EUVD-2026-123048

An expression language injection has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the Pulpcore package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for...

EUVD-2026-123047

An out-of-bounds write in the AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to corrupt global firmware variables, potentially resulting in loss of integrity...

EUVD-2026-123046

Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality...

EUVD-2026-123045

Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to potentially launch a guest whose attestation report contains an ID key digest for an ID block that doesn't match the guest's measurement resulting in loss of...

EUVD-2026-123044

Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to change the encryption bit for guest context pages potentially resulting in loss of integrity...

EUVD-2026-123043

Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to potentially affect cache coherency for guest context pages resulting in loss of integrity...

EUVD-2026-123042

Authentication bypass by spoofing in AMD Secure Encrypted Virtualization SEV firmware could allow a malicious hypervisor to request attestation reports for VMPL 0...

EUVD-2026-123041

An off-by-one error in AMD Secure Encrypted Virtualization SEV firmware could allow an attacker with hypervisor access to corrupt the Reverse Map Table RMP table, potentially resulting in loss of guest memory integrity...

EUVD-2026-123040

Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging SEV-SNP could allow a privileged attacker to potentially overlap MMIO regions with DRAM regions resulting in loss of integrity...

EUVD-2026-123039

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

EUVD-2026-123038

The simulated EEPROM driver validated access ranges in eepromrangeisvalid drivers/eeprom/eepromsimulator.c with a single test, offset + len size. Because offset is a signed offt and len an unsigned sizet of the same rank, the addition is evaluated in unsigned arithmetic: a negative offset combine...

EUVD-2026-123037

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...

EUVD-2026-123036

The IEEE 1588 PTP port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received DelayResp message without any validation. portdelayrespmsgprocess stored the raw wire value a full-range int8t into portds.logmindelayreqinterval, and that value is later used as ...

EUVD-2026-123035

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/httpserverhttp2.c, handlehttp2staticfsresource passed &client-datalen as the filesize out-parameter of httpserverfindfile. client-datalen is the count of unprocessed bytes...

EUVD-2026-123034

bthcileperadvreportcommon in subsys/bluetooth/host/scan.c handles the HCILEPeriodicAdvertisingReport and v2 event. It verified that the fixed event header was present and that the controller-declared DataLength fits the tailroom of the periodic-sync reassembly buffer, but never checked that the...

EUVD-2026-123033

Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim,...

EUVD-2026-123032

Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17...

EUVD-2026-123031

Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17...

EUVD-2026-123030

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

EUVD-2026-123029

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-123028

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

EUVD-2026-123027

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and write access. Exploitation of this issu...

EUVD-2026-123026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-123025

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-123024

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-123023

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

EUVD-2026-123022

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-123021

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

EUVD-2026-123020

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

EUVD-2026-123019

Adobe Experience Manager is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

EUVD-2026-123018

Adobe Experience Manager is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

EUVD-2026-123017

Adobe Experience Manager is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is...