CVE-2025-64121 | CRITICAL | 10.0 | 0.00359 | 40.13 | No | No | 2026-01-02 | 2026-01-05 | euvd | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication…Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1. |
CVE-2025-1867 | CRITICAL | 10.0 | 0.00371 | 40.13 | No | No | 2025-03-03 | 2025-03-03 | euvd | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggli…Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affects libhv: through 1.3.3. |
CVE-2026-40772 | CRITICAL | 10.0 | 0.00359 | 40.13 | No | No | 2026-06-15 | 2026-06-16 | euvd | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. |
CVE-2026-48056 | CRITICAL | 10.0 | 0.00379 | 40.13 | No | No | 2026-08-11 | 2026-08-11 | euvd, nvd | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate execu…Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch. |
CVE-2022-30133 | CRITICAL | 9.8 | 0.02653 | 40.13 | No | No | 2022-08-09 | 2025-01-02 | euvd | Windows Point-to-Point Protocol (PPP) Remote Code Execution VulnerabilityWindows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability |
CVE-2022-27596 | CRITICAL | 9.8 | 0.02663 | 40.13 | No | No | 2023-01-30 | 2025-03-27 | euvd | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to …A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code.
We have already fixed this vulnerability in the following versions of QuTS hero, QTS:
QuTS hero h5.0.1.2248 build 20221215 and later
QTS 5.0.1.2234 build 20221201 and later |
CVE-2025-70841 | CRITICAL | 10.0 | 0.00383 | 40.13 | No | No | 2026-02-03 | 2026-02-04 | euvd | Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configurati…Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key (APP_KEY), database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, enabling complete system compromise including authentication bypass via session token forgery, direct database access to all tenant data, and email infrastructure takeover. Due to the multi-tenancy architecture, this vulnerability affects all tenants in the system. |
CVE-2026-8982 | CRITICAL | 10.0 | 0.00384 | 40.13 | No | No | 2026-07-21 | 2026-07-22 | euvd, nvd | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password …Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges. |
CVE-2026-2768 | CRITICAL | 10.0 | 0.00366 | 40.13 | No | No | 2026-02-24 | 2026-07-15 | cnvd, euvd | Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thu…Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2025-69426 | CRITICAL | 10.0 | 0.00368 | 40.13 | No | No | 2026-01-09 | 2026-07-28 | euvd | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account w…The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise. |
CVE-2026-16367 | CRITICAL | 10.0 | 0.00375 | 40.13 | No | Yes | 2026-07-21 | 2026-07-22 | euvd, nvd, packetstorm | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 1…Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2025-64090 | CRITICAL | 10.0 | 0.00368 | 40.13 | No | No | 2026-01-09 | 2026-01-09 | euvd | This vulnerability allows authenticated attackers to execute commands via the hostname of the device.This vulnerability allows authenticated attackers to execute commands via the hostname of the device. |
CVE-2025-15586 | CRITICAL | 10.0 | 0.00382 | 40.13 | No | No | 2026-02-19 | 2026-02-24 | euvd | OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can r…OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password. |
CVE-2026-9152 | CRITICAL | 10.0 | 0.00339 | 40.12 | No | No | 2026-05-21 | 2026-05-21 | euvd, nvd | A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations withou…A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries.
Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected. |
CVE-2026-62422 | CRITICAL | 10.0 | 0.00329 | 40.12 | No | No | 2026-07-14 | 2026-07-15 | euvd, nvd | In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass v…In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible |
CVE-2026-44329 | CRITICAL | 10.0 | 0.00331 | 40.12 | No | Yes | 2026-05-27 | 2026-05-28 | euvd, packetstorm | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without…free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2. |
CVE-2021-34727 | CRITICAL | 9.8 | 0.02629 | 40.12 | No | No | 2021-09-23 | 2024-11-07 | euvd | A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer ove…A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device. A successful exploit could allow the attacker to cause a buffer overflow and possibly execute arbitrary commands with root-level privileges, or cause the device to reload, which could result in a denial of service condition. |
CVE-2024-0705 | CRITICAL | 9.8 | 0.02635 | 40.12 | No | No | 2024-01-19 | 2026-04-08 | euvd | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, …The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
CVE-2026-16498 | CRITICAL | 10.0 | 0.0033 | 40.12 | No | No | 2026-07-28 | 2026-07-28 | euvd, nvd | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transp…The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0. |
CVE-2026-57719 | CRITICAL | 10.0 | 0.00347 | 40.12 | No | No | 2026-07-13 | 2026-07-13 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This is…Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3. |
CVE-2025-12516 | CRITICAL | 10.0 | 0.00345 | 40.12 | No | No | 2025-10-30 | 2025-10-30 | euvd | Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2026-56699 | CRITICAL | 10.0 | 0.00351 | 40.12 | No | No | 2026-07-15 | 2026-08-06 | euvd, nvd | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Per Wazuh's Security Policy, vulnerabilities affecting only non-G…This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Per Wazuh's Security Policy, vulnerabilities affecting only non-GA versions are not eligible for a CVE ID. |
CVE-2025-55051 | CRITICAL | 10.0 | 0.00342 | 40.12 | No | No | 2025-09-09 | 2025-09-10 | euvd | CWE-1392: Use of Default CredentialsCWE-1392: Use of Default Credentials |
CVE-2020-6140 | CRITICAL | 9.8 | 0.02634 | 40.12 | No | No | 2020-09-01 | 2024-08-04 | euvd | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the passwor…SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability. |
CVE-2020-6139 | CRITICAL | 9.8 | 0.02634 | 40.12 | No | No | 2020-09-01 | 2024-08-04 | euvd | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the passwor…SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability. |
CVE-2024-38369 | CRITICAL | 10.0 | 0.00342 | 40.12 | No | No | 2024-06-24 | 2024-08-02 | euvd | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included …XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe. |
CVE-2026-45631 | CRITICAL | 10.0 | 0.00351 | 40.12 | No | No | 2026-05-29 | 2026-06-01 | euvd, nvd | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("bette…Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3. |
CVE-2017-2922 | CRITICAL | 9.8 | 0.02625 | 40.12 | No | No | 2017-11-07 | 2024-09-16 | euvd | An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted …An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability. |
CVE-2025-54419 | CRITICAL | 10.0 | 0.00357 | 40.12 | No | No | 2025-07-28 | 2025-07-28 | euvd | A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) origin…A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0. |
CVE-2026-9508 | CRITICAL | 10.0 | 0.00341 | 40.12 | No | No | 2026-05-29 | 2026-05-29 | euvd, nvd | Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publ…Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement. |
CVE-2025-11778 | CRITICAL | 10.0 | 0.00342 | 40.12 | No | No | 2025-12-02 | 2025-12-02 | euvd | Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corru…Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation. |
CVE-2025-41672 | CRITICAL | 10.0 | 0.00346 | 40.12 | No | No | 2025-07-07 | 2025-07-07 | euvd | A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected dev…A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. |
CVE-2022-2272 | CRITICAL | 9.8 | 0.0264 | 40.12 | No | No | 2022-08-03 | 2024-08-03 | euvd | This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is …This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the login endpoint. When parsing the username element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17331. |
CVE-2025-48748 | CRITICAL | 10.0 | 0.00342 | 40.12 | No | No | 2025-05-29 | 2025-05-29 | euvd | Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password. |
CVE-2023-34157 | CRITICAL | 10.0 | 0.00353 | 40.12 | No | No | 2023-06-16 | 2024-12-17 | euvd | Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app. |
CVE-2026-38708 | CRITICAL | 9.8 | 0.02619 | 40.12 | No | No | 2026-07-31 | 2026-08-03 | euvd, nvd | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2…TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input. |
CVE-2026-64633 | CRITICAL | 10.0 | 0.00337 | 40.12 | No | Yes | 2026-08-04 | 2026-08-05 | euvd, github, nvd | A vulnerability allowing remote unauthenticated code execution on the agent host.A vulnerability allowing remote unauthenticated code execution on the agent host. |
CVE-2025-12515 | CRITICAL | 10.0 | 0.00345 | 40.12 | No | No | 2025-10-30 | 2025-10-30 | euvd | Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2026-40965 | CRITICAL | 10.0 | 0.00346 | 40.12 | No | No | 2026-06-01 | 2026-06-03 | euvd, nvd | Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC …Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing.
Affected versions:
- uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later
- CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0) |
CVE-2025-12219 | CRITICAL | 10.0 | 0.00345 | 40.12 | No | No | 2025-10-25 | 2025-10-28 | euvd | Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2026-46389 | CRITICAL | 10.0 | 0.00341 | 40.12 | No | No | 2026-06-05 | 2026-06-05 | euvd | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deploy…UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue. |
CVE-2026-24729 | CRITICAL | 10.0 | 0.00336 | 40.12 | No | No | 2026-01-30 | 2026-01-30 | euvd | An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10…An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute arbitrary system commands via a malicious class file. |
CVE-2025-49444 | CRITICAL | 10.0 | 0.00338 | 40.12 | No | No | 2025-06-17 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web She…Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5. |
CVE-2024-47066 | CRITICAL | 9.0 | 0.11765 | 40.12 | No | No | 2024-09-23 | 2024-09-23 | euvd | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection impleme…Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue. |
CVE-2025-49414 | CRITICAL | 10.0 | 0.00338 | 40.12 | No | No | 2025-07-04 | 2026-05-12 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue a…Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery: from n/a through <= 8.0.0. |
CVE-2025-49885 | CRITICAL | 10.0 | 0.00348 | 40.12 | No | No | 2025-06-27 | 2026-05-12 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-d…Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6. |
CVE-2019-9885 | CRITICAL | 9.8 | 0.02624 | 40.12 | No | No | 2019-07-25 | 2024-09-17 | euvd | eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter. |
CVE-2025-49447 | CRITICAL | 10.0 | 0.00338 | 40.12 | No | No | 2025-06-17 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects …Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0. |
CVE-2025-30933 | CRITICAL | 10.0 | 0.00338 | 40.12 | No | No | 2025-07-04 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web …Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue affects LogisticsHub: from n/a through <= 1.1.6. |
CVE-2026-33712 | CRITICAL | 10.0 | 0.00347 | 40.12 | No | No | 2026-05-22 | 2026-05-22 | euvd, nvd | Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startC…Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Request Forgery (SSRF) by supplying a custom typebot definition with server-side code blocks. The fetch function exposed inside the isolated-vm sandbox calls Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects the HTTP Request block. This bypasses all SSRF mitigations added after GHSA-8gq9-rw7v-3jpr. Exploitation of this unauthenticated SSRF vulnerability can lead to cloud credential theft, internal network access and data exfiltration for any self-hosted Typebot deployments and hosted services. This issue has been fixed in version 3.16.0. |