CVE-2022-31692 | CRITICAL | 9.8 | 0.03429 | 40.4 | No | No | 2022-10-31 | 2025-05-06 | euvd | Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includ…Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true) |
CVE-2023-1283 | CRITICAL | 10.0 | 0.01149 | 40.4 | No | No | 2023-03-08 | 2025-03-05 | euvd | Code Injection in GitHub repository builderio/qwik prior to 0.21.0.Code Injection in GitHub repository builderio/qwik prior to 0.21.0. |
CVE-2017-13037 | CRITICAL | 9.8 | 0.03428 | 40.4 | No | No | 2017-09-14 | 2025-12-05 | euvd | The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts(). |
CVE-2022-2970 | CRITICAL | 10.0 | 0.0115 | 40.4 | No | No | 2022-09-23 | 2025-04-16 | euvd | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize…MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code. |
CVE-2025-34223 | CRITICAL | 10.0 | 0.01152 | 40.4 | No | No | 2025-09-29 | 2026-05-15 | euvd | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS d…Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation‑time endpoint at `/admin/query/update_database.php` that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary `root_user` and `root_password` values, causing the script to replace the default admin credentials with attacker‑controlled ones. The script also contains hard‑coded SHA‑512 and SHA‑1 hashes of the default password, allowing the attacker to bypass password‑policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during the initial setup. This vulnerability has been identified by the vendor as: V-2024-022 — Insecure Installation Credentials. |
CVE-2026-11429 | CRITICAL | 10.0 | 0.01145 | 40.4 | No | No | 2026-06-05 | 2026-06-09 | euvd, nvd | Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-su…Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system.
An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level. |
CVE-2013-10066 | CRITICAL | 10.0 | 0.01154 | 40.4 | No | No | 2025-08-05 | 2026-04-07 | euvd | An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_a…An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request. |
CVE-2020-12030 | CRITICAL | 10.0 | 0.01131 | 40.4 | No | No | 2021-09-29 | 2024-08-04 | euvd | There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables th…There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the internal gateway firewall becomes disabled resulting in exposure of all ports used by the gateway. |
CVE-2023-40151 | CRITICAL | 10.0 | 0.01149 | 40.4 | No | No | 2023-11-21 | 2026-02-25 | euvd | When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RT…When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge. |
CVE-2021-44159 | CRITICAL | 9.8 | 0.03409 | 40.39 | No | No | 2021-12-20 | 2024-09-17 | euvd | 4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshel…4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack. |
CVE-2022-44588 | CRITICAL | 9.9 | 0.02249 | 40.39 | No | No | 2022-12-15 | 2026-04-28 | euvd | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. |
CVE-2019-17536 | CRITICAL | 9.9 | 0.02254 | 40.39 | No | No | 2019-10-13 | 2024-08-05 | euvd | Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. T…Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move. |
CVE-2020-26085 | CRITICAL | 9.9 | 0.02244 | 40.39 | No | No | 2021-01-06 | 2024-11-12 | euvd | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute a…Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2022-22817 | CRITICAL | 9.8 | 0.03399 | 40.39 | No | No | 2022-01-07 | 2024-10-15 | euvd | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda…PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. |
CVE-2023-38692 | CRITICAL | 9.8 | 0.03388 | 40.39 | No | No | 2023-08-04 | 2024-10-10 | euvd | CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerabili…CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading. |
CVE-2026-21667 | CRITICAL | 10.0 | 0.01128 | 40.39 | No | No | 2026-03-12 | 2026-03-13 | euvd | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2021-41280 | CRITICAL | 9.8 | 0.034 | 40.39 | No | No | 2021-11-19 | 2024-08-04 | euvd | Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installatio…Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value. |
CVE-2022-22823 | CRITICAL | 9.8 | 0.03404 | 40.39 | No | No | 2022-01-08 | 2025-05-05 | euvd | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2023-26472 | CRITICAL | 10.0 | 0.01107 | 40.39 | No | No | 2023-03-02 | 2025-03-05 | euvd | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconTheme…XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38. |
CVE-2021-20998 | CRITICAL | 10.0 | 0.01111 | 40.39 | No | No | 2021-05-13 | 2024-09-17 | euvd | In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create…In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users. |
CVE-2023-31478 | HIGH | 7.5 | 0.29699 | 40.39 | No | No | 2023-05-09 | 2025-01-29 | euvd | An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SS…An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. |
CVE-2024-6071 | CRITICAL | 10.0 | 0.01118 | 40.39 | No | No | 2024-06-27 | 2024-08-01 | euvd | PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary O…PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server. |
CVE-2024-21574 | CRITICAL | 10.0 | 0.01107 | 40.39 | No | No | 2024-12-12 | 2024-12-12 | euvd | The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom…The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server. |
CVE-2019-13343 | CRITICAL | 9.9 | 0.02248 | 40.39 | No | No | 2019-10-02 | 2024-08-04 | euvd | Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectivel…Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename. |
CVE-2023-2583 | CRITICAL | 10.0 | 0.01128 | 40.39 | No | No | 2023-05-08 | 2025-01-28 | euvd | Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3. |
CVE-2026-21666 | CRITICAL | 10.0 | 0.01128 | 40.39 | No | No | 2026-03-12 | 2026-03-13 | euvd | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2025-23123 | CRITICAL | 10.0 | 0.0112 | 40.39 | No | No | 2025-05-19 | 2025-05-19 | euvd | A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vul…A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras (Version 4.75.43 and earlier) firmware. |
CVE-2024-24402 | CRITICAL | 9.8 | 0.03398 | 40.39 | No | No | 2024-02-26 | 2025-03-24 | euvd | An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd compo…An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. |
CVE-2020-3227 | CRITICAL | 9.8 | 0.03408 | 40.39 | No | No | 2020-06-03 | 2024-11-15 | euvd | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an u…A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests for authorization tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token. An exploit could allow the attacker to obtain an authorization token and execute any of the IOx API commands on an affected device. |
CVE-2022-22824 | CRITICAL | 9.8 | 0.03404 | 40.39 | No | No | 2022-01-08 | 2025-05-05 | euvd | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-48253 | CRITICAL | 9.8 | 0.03406 | 40.39 | No | No | 2023-01-11 | 2025-04-08 | euvd | nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote serve…nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used. |
CVE-2017-2916 | CRITICAL | 9.9 | 0.02251 | 40.39 | No | No | 2017-11-07 | 2024-09-17 | euvd | An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted…An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability. |
CVE-2023-1778 | CRITICAL | 10.0 | 0.01128 | 40.39 | No | No | 2023-04-27 | 2025-01-30 | euvd | This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default creden…This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems.
The vulnerability has been addressed by forcing the user to change their default password to a new non-default password. |
CVE-2024-39791 | CRITICAL | 10.0 | 0.01114 | 40.39 | No | No | 2024-08-08 | 2024-08-21 | euvd | Stack-based buffer overflow vulnerabilities affecting Vonets
industrial wifi bridge relays and wifi bridge repeaters, software versio…Stack-based buffer overflow vulnerabilities affecting Vonets
industrial wifi bridge relays and wifi bridge repeaters, software versions
3.3.23.6.9 and prior, enable an unauthenticated remote attacker to
execute arbitrary code. |
CVE-2026-23830 | CRITICAL | 10.0 | 0.01122 | 40.39 | No | No | 2026-01-27 | 2026-01-28 | euvd | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being …SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () => {}).constructor`). In `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor. Constructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining the host `AsyncFunction` constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution). Version 0.8.26 patches this vulnerability. |
CVE-2019-5085 | CRITICAL | 9.8 | 0.03366 | 40.38 | No | No | 2019-12-11 | 2024-08-04 | euvd | An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.1…An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow, resulting in heap corruption. An attacker can send a packet to trigger this vulnerability. |
CVE-2023-26822 | CRITICAL | 9.8 | 0.0337 | 40.38 | No | No | 2023-04-01 | 2025-02-11 | euvd | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main.D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main. |
CVE-2023-45144 | CRITICAL | 10.0 | 0.01088 | 40.38 | No | No | 2023-10-16 | 2024-09-16 | euvd | com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. Whe…com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade. |
CVE-2024-2973 | CRITICAL | 10.0 | 0.01088 | 40.38 | No | No | 2024-06-27 | 2024-08-01 | euvd | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with…An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device.
Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability.
No other Juniper Networks products or platforms are affected by this issue.
This issue affects:
Session Smart Router:
* All versions before 5.6.15,
* from 6.0 before 6.1.9-lts,
* from 6.2 before 6.2.5-sts.
Session Smart Conductor:
* All versions before 5.6.15,
* from 6.0 before 6.1.9-lts,
* from 6.2 before 6.2.5-sts.
WAN Assurance Router:
* 6.0 versions before 6.1.9-lts,
* 6.2 versions before 6.2.5-sts. |
CVE-2025-23922 | CRITICAL | 10.0 | 0.01074 | 40.38 | No | No | 2025-01-16 | 2026-04-28 | euvd | Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue…Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0. |
CVE-2021-27391 | CRITICAL | 9.8 | 0.03369 | 40.38 | No | No | 2021-09-14 | 2025-04-23 | euvd | A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions…A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges. |
CVE-2024-37642 | CRITICAL | 9.1 | 0.11374 | 40.38 | No | No | 2024-06-14 | 2024-08-02 | euvd | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /fo…TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck . |
CVE-2025-62725 | HIGH | 8.9 | 0.13653 | 40.38 | No | Yes | 2025-10-27 | 2025-10-28 | euvd, packetstorm | Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compos…Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2. |
CVE-2025-29774 | CRITICAL | 9.3 | 0.09096 | 40.38 | No | No | 2025-03-14 | 2025-03-15 | euvd | xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions pr…xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively. |
CVE-2022-46742 | CRITICAL | 10.0 | 0.01096 | 40.38 | No | No | 2022-12-07 | 2025-04-22 | euvd | Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. |
CVE-2025-20309 | CRITICAL | 10.0 | 0.01099 | 40.38 | No | No | 2025-07-02 | 2026-02-26 | euvd | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Un…A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.
This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. |
CVE-2025-9713 | HIGH | 8.8 | 0.14805 | 40.38 | No | No | 2025-10-13 | 2026-02-26 | euvd | Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.…Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. |
CVE-2020-9409 | CRITICAL | 9.8 | 0.03375 | 40.38 | No | No | 2020-05-20 | 2024-09-17 | euvd | The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIB…The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below. |
CVE-2025-53767 | CRITICAL | 10.0 | 0.01079 | 40.38 | No | No | 2025-08-07 | 2026-02-26 | euvd | Azure OpenAI Elevation of Privilege VulnerabilityAzure OpenAI Elevation of Privilege Vulnerability |
CVE-2026-25142 | CRITICAL | 10.0 | 0.01091 | 40.38 | No | No | 2026-02-02 | 2026-02-04 | euvd | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obt…SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27. |