432695 matches found
EUVD-2026-54086
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...
EUVD-2026-54085
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...
EUVD-2026-54084
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...
EUVD-2026-54083
Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...
EUVD-2026-54082
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
EUVD-2026-54081
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...
EUVD-2026-54080
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
EUVD-2026-54079
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
EUVD-2026-54078
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...
EUVD-2026-53920
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
EUVD-2025-210642
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
EUVD-2026-53919
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...
EUVD-2026-53918
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...
EUVD-2026-53917
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
EUVD-2026-53916
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
EUVD-2026-53915
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component getcredentialfromuser. This manipulation of the argument Description causes command injection. It is...
EUVD-2026-53914
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
EUVD-2026-53912
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
EUVD-2026-53913
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
EUVD-2026-53911
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
EUVD-2026-53910
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
EUVD-2026-53909
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
EUVD-2026-53908
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
EUVD-2026-53907
Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...
EUVD-2026-53906
Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...
EUVD-2026-53905
Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...
EUVD-2026-53904
Custom role Broken Access Control in Dokan = 5.0.10 versions...
EUVD-2026-53903
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
EUVD-2026-53902
Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
EUVD-2026-53901
Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...
EUVD-2026-53899
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
EUVD-2026-53897
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
EUVD-2026-53898
Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...
EUVD-2026-53896
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
EUVD-2026-53894
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
EUVD-2026-53895
Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...
EUVD-2026-53893
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
EUVD-2026-53892
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
EUVD-2026-53891
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
EUVD-2026-53890
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...
EUVD-2026-53888
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...
EUVD-2026-53889
Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
EUVD-2026-53887
Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...
EUVD-2026-53886
Unauthenticated Cross Site Scripting XSS in Events Manager = 7.4.1 versions...
EUVD-2026-53885
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...
EUVD-2026-53884
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...
EUVD-2026-53883
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...