Lucene search
K

418162 matches found

EUVD
EUVD
added 2026/06/18 5:53 p.m.9 views

EUVD-2026-37926

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy...

7.3CVSS5.2AI score0.00329EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 5:33 p.m.13 views

EUVD-2026-37925

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...

9.8CVSS5.8AI score0.00333EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 5:30 p.m.9 views

EUVD-2026-37924

pamusb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusbisloginctllocal can cause a NULL dereference crash when parsing loginctl output. The function calls popen and reads the result; if the Remote field is only a newline, fgets succeeds...

5.5CVSS5.4AI score0.00113EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 5:20 p.m.9 views

EUVD-2026-37923

pamusb provides hardware authentication for Linux using removable media. In pamusb 0.9.1 and earlier, usbgetprocessparentid can cause an infinite loop DoS because it does not initialize ppid on failure. In pusblocallogin, the same variable is reused as input and output in a process-tree while loo...

4.7CVSS5.3AI score0.00104EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 5:6 p.m.9 views

EUVD-2026-37922

pamusb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree memory release helper in calls free without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read fr...

4.7CVSS5.6AI score0.00109EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 4:25 p.m.9 views

EUVD-2025-210284

CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged...

7.5CVSS5.3AI score0.00384EPSS
Exploits0References6
EUVD
EUVD
added 2026/06/18 4:22 p.m.11 views

EUVD-2026-37916

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting XSS vulnerability in the Admin2 Pages API save flow...

5.1CVSS4.8AI score0.00299EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:21 p.m.9 views

EUVD-2026-37915

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting XSS vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter next, which is...

8.8CVSS5.5AI score0.00189EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:21 p.m.9 views

EUVD-2026-37914

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

1.8CVSS4.7AI score0.00208EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 4:20 p.m.9 views

EUVD-2025-210283

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, MediaDurationBlock will download and store the video in a temporary directory without deleting before all noded are done. StepThroughItemsBlock can be used t...

8.7CVSS5.3AI score0.00276EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:18 p.m.8 views

EUVD-2025-210282

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AddAudioToVideoBlock will download and store the video and audio in a temporary directory without deleting before all noded are done. StepThroughItemsBlock c...

7.1CVSS5.3AI score0.00247EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:14 p.m.10 views

EUVD-2025-210281

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBlock will store the captured screenshots in a temporary directory. StepThroughItemsBlock can be used to iterate ScreenshotWebPageBlock...

8.7CVSS5.3AI score0.00276EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:13 p.m.8 views

EUVD-2026-37913

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network...

5.1CVSS5.3AI score0.00289EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:13 p.m.11 views

EUVD-2026-37912

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

6.9CVSS5.3AI score0.003EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:12 p.m.8 views

EUVD-2026-37911

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...

8.8CVSS5.2AI score0.004EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:12 p.m.8 views

EUVD-2025-210280

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, StepThroughItemsBlock can iterate all the contents in a list and send them to FileStoreBlock for downloading one by one. Although FileStoreBlock has access...

8.7CVSS5.3AI score0.00276EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:12 p.m.11 views

EUVD-2026-37910

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...

9.8CVSS5.4AI score0.00427EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:12 p.m.10 views

EUVD-2026-37909

The Webmin HTTP server miniserv.pl allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.641...

9.2CVSS5.3AI score0.00285EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:11 p.m.8 views

EUVD-2026-37908

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern...

6.9CVSS5.2AI score0.0028EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:11 p.m.9 views

EUVD-2026-37907

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.641...

6.9CVSS5.2AI score0.00308EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 4:8 p.m.9 views

EUVD-2025-210279

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AutoGPT's LoopVideoBLock allows users to input a video file and process the video, such as looping it 5 times or extending the time, and finally writing it t...

8.7CVSS5.3AI score0.00343EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 4:5 p.m.9 views

EUVD-2026-37906

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert within src/hpack-tbl.c that fails to validate the return value of hpackdhtdefrag when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memo...

8.7CVSS5.3AI score0.00431EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 4:5 p.m.11 views

EUVD-2026-37905

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...

9CVSS5.6AI score0.00321EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 3:49 p.m.8 views

EUVD-2026-37904

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and...

6.9CVSS5.3AI score0.00301EPSS
Exploits0References5
EUVD
EUVD
added 2026/06/18 3:27 p.m.8 views

EUVD-2026-37903

Cross-Site Request Forgery CSRF vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.4.0...

6.5CVSS5.2AI score0.00124EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 3:4 p.m.7 views

EUVD-2026-37816

BBOT: Symlink-Following Arbitrary Write via githubworkflows Module...

2.2CVSS5.2AI score0.00091EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 3:3 p.m.9 views

EUVD-2026-37818

BBOT: Arbitrary File Write in postmandownload Module...

6.5CVSS5.2AI score0.00251EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 3:3 p.m.8 views

EUVD-2026-37814

BBOT: Server-Side Request Forgery SSRF in dockerpull module via WWW-Authenticate realm parsing...

3.1CVSS5.2AI score0.00167EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 3:2 p.m.8 views

EUVD-2026-37812

BBOT: Path traversal Zip-Slip in unarchive module - incomplete fix for CVE-2025-10284...

9.6CVSS5.1AI score0.00658EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:52 p.m.13 views

EUVD-2026-37163

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags...

9.8CVSS5.2AI score0.0024EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:44 p.m.7 views

EUVD-2026-37902

A flaw was found in 389 Directory Server. During schema reload, the attrsyntaxswapht function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while...

5CVSS5.2AI score0.00212EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:35 p.m.9 views

EUVD-2026-37901

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files e.g. .theia/tasks.json, .vscode/tasks.json could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitra...

8.4CVSS5.7AI score0.00231EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 2:32 p.m.8 views

EUVD-2026-37900

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs...

6.7CVSS5.4AI score0.00181EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 2:31 p.m.7 views

EUVD-2025-210278

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses ENTITYRESOLUTIONALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery SSRF. This vulnerability requires that GeoServer i...

6.5CVSS5.3AI score0.00287EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:28 p.m.9 views

EUVD-2025-210277

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web pa...

7.2CVSS7.6AI score0.58974EPSS
Exploits20References4
EUVD
EUVD
added 2026/06/18 2:28 p.m.10 views

EUVD-2026-37763

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent...

7.4CVSS5.8AI score0.00459EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:28 p.m.12 views

EUVD-2026-37766

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass...

5.9CVSS7AI score0.00374EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:28 p.m.12 views

EUVD-2026-37752

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass...

7.5CVSS5.8AI score0.00426EPSS
Exploits0References3
EUVD
EUVD
added 2026/06/18 2:28 p.m.12 views

EUVD-2026-37730

python-statemachine SCXML Eval Injection...

9.8CVSS5.2AI score0.00801EPSS
Exploits1References4
EUVD
EUVD
added 2026/06/18 2:26 p.m.8 views

EUVD-2026-37899

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the...

8.4CVSS5.6AI score0.00272EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 2:23 p.m.10 views

EUVD-2025-210276

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution RCE. Version 2.27.0 fixes...

8.8CVSS7.4AI score0.01378EPSS
Exploits0References4
EUVD
EUVD
added 2026/06/18 2:22 p.m.11 views

EUVD-2026-37898

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed...

8.4CVSS5.7AI score0.00272EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 2:13 p.m.10 views

EUVD-2026-37897

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agentid value into outgoing gRPC metadata. The server correctl...

7.1CVSS5.4AI score0.00246EPSS
Exploits0References5
EUVD
EUVD
added 2026/06/18 2:10 p.m.9 views

EUVD-2026-37896

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory use-after-free...

7.2CVSS5.3AI score0.00304EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 2:2 p.m.8 views

EUVD-2026-37895

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL Injection. This issue affects Media LIbrary Assistant: from n/a through 3.35...

8.5CVSS5.6AI score0.00211EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 1:55 p.m.8 views

EUVD-2026-37894

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-tim...

6CVSS5.3AI score0.00154EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 1:51 p.m.7 views

EUVD-2026-37893

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

5.7CVSS5.5AI score0.00097EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 1:48 p.m.7 views

EUVD-2026-37892

Docker Sandboxes sbx enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which t...

5.7CVSS5.3AI score0.00103EPSS
Exploits0References2
EUVD
EUVD
added 2026/06/18 1:47 p.m.7 views

EUVD-2026-37891

Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache...

8.1CVSS5.4AI score0.00353EPSS
Exploits0References1
EUVD
EUVD
added 2026/06/18 1:47 p.m.8 views

EUVD-2026-37890

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these...

6.5CVSS5.3AI score0.002EPSS
Exploits0References1
Total number of security vulnerabilities418162