#euvd — Public Fediverse posts

🚨 EUVD-2026-100192

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: Microsoft SharePoint Server Subscription Edition
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100192

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102870

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: aThemeArt Theme Helper
🏢 Vendor: aThemeArt
📅 Updated: 2026-10-16

📝 Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102870

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102872

📊 Score: 5.4/10 (CVSS v3.1)
📦 Product: Crafty Controller
🏢 Vendor: Arcadia Technology, LLC
📅 Updated: 2026-10-16

📝 An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102872

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102873

📊 Score: 9.6/10 (CVSS v3.1)
📦 Product: Crafty Controller
🏢 Vendor: Arcadia Technology, LLC
📅 Updated: 2026-10-16

📝 An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102873

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102874

📊 Score: n/a
📦 Product: Server
🏢 Vendor: Devolutions
📅 Updated: 2026-10-16

📝 Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102874

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102875

📊 Score: n/a
📦 Product: Server
🏢 Vendor: Devolutions
📅 Updated: 2026-10-16

📝 Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102875

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102876

📊 Score: n/a
📦 Product: Server
🏢 Vendor: Devolutions
📅 Updated: 2026-10-16

📝 Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplie...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102876

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102866

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: Advanced Post Manager
🏢 Vendor: Liquid Web / StellarWP
📅 Updated: 2026-10-16

📝 Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102866

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102860

📊 Score: 6.5/10 (CVSS v3.1)
📦 Product: MapSVG
🏢 Vendor: PT Norther Lights Production
📅 Updated: 2026-10-16

📝 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102860

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102877

📊 Score: n/a
📦 Product: Server
🏢 Vendor: Devolutions
📅 Updated: 2026-10-16

📝 Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102877

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102856

📊 Score: 7.5/10 (CVSS v3.1)
📅 Updated: 2026-10-16

📝 A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102856

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102869

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Passster
🏢 Vendor: WP Chill
📅 Updated: 2026-10-16

📝 Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102869

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102868

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: csaf_provider
🏢 Vendor: gocsaf Development Community
📅 Updated: 2026-10-16

📝 An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102868

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102858

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MapSVG
🏢 Vendor: PT Norther Lights Production
📅 Updated: 2026-10-16

📝 Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102858

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102878

📊 Score: 9.3/10 (CVSS v3.1)
📦 Product: EseeCloud App, EseeCloud Firmware
🏢 Vendor: Guangzhou Juan IoT Technology Co., Ltd.
📅 Updated: 2026-10-16

📝 An attacker can use a hard-coded credential to log in to EseeCloud devices.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102878

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102851

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Apache Kylin
🏢 Vendor: Apache Software Foundation
📅 Updated: 2026-10-16

📝 Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102851

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102879

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: EseeCloud App, EseeCloud Firmware
🏢 Vendor: Guangzhou Juan IoT Technology Co., Ltd.
📅 Updated: 2026-10-16

📝 An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different accoun...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102879

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102880

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: EseeCloud App, EseeCloud Firmware
🏢 Vendor: Guangzhou Juan IoT Technology Co., Ltd.
📅 Updated: 2026-10-16

📝 The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, r...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102880

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99430

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Windows Server 2012 R2, Windows Server 2025 (Server Core installation), Windows Server 2019 (Server Core installation) (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99430

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99432

📊 Score: 6.6/10 (CVSS v3.1)
📦 Product: Windows Server 2019 (Server Core installation), Windows Server 2012 (Server Core installation), Windows Server 2016 (Server Core installation) (+10 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Use after free in Windows DHCP Server allows an authorized attacker to execute code ov...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99432

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99433

📊 Score: 8.1/10 (CVSS v3.1)
📦 Product: Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 10 Version 1607 (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99433

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99609

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: Windows 11 version 26H1, Windows Server 2012, Windows 10 Version 21H2 (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99609

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99608

📊 Score: 8.1/10 (CVSS v3.1)
📦 Product: Windows Server 2016, Windows Server 2025 (Server Core installation), Windows Server 2016 (Server Core installation) (+8 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99608

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99434

📊 Score: 7.0/10 (CVSS v3.1)
📦 Product: Windows 11 Version 26H2, Windows 10 Version 21H2, Windows Server 2012 (Server Core installation) (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99434

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99435

📊 Score: 7.0/10 (CVSS v3.1)
📦 Product: Windows Server 2022, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation) (+10 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99435

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99610

📊 Score: 8.0/10 (CVSS v3.1)
📦 Product: Microsoft Power Apps for Android
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99610

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99611

📊 Score: 5.5/10 (CVSS v3.1)
📦 Product: Windows 11 Version 25H2, Windows 11 Version 23H2, Windows 10 Version 21H2 (+13 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99611

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99612

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Windows Server 2019, Windows Server 2016, Windows Server 2019 (Server Core installation) (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99612

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-99436

📊 Score: 7.0/10 (CVSS v3.1)
📦 Product: Windows Server 2016, Windows 11 Version 26H2, Windows 10 Version 21H2 (+17 more)
🏢 Vendor: Microsoft
📅 Published: 2026-10-13 | Updated: 2026-10-16

📝 Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-99436

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102843

📊 Score: 7.2/10 (CVSS v3.1)
📦 Product: WP Sessions Time Monitoring Full Automatic
🏢 Vendor: switcorp
📅 Updated: 2026-10-16

📝 The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' param...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102843

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102844

📊 Score: 6.0/10 (CVSS v3.1)
📦 Product: erupt
🏢 Vendor: erupts
📅 Updated: 2026-10-16

📝 Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permissi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102844

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101220

📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: BottleCRM
🏢 Vendor: MicroPyramid
📅 Published: 2026-10-14 | Updated: 2026-10-16

📝 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML a...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101220

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101222

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: BottleCRM
🏢 Vendor: MicroPyramid
📅 Published: 2026-10-14 | Updated: 2026-10-16

📝 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can c...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101222

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101223

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: BottleCRM
🏢 Vendor: MicroPyramid
📅 Published: 2026-10-14 | Updated: 2026-10-16

📝 BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101223

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101259

📊 Score: 9.3/10 (CVSS v3.1)
📦 Product: komodo
🏢 Vendor: moghtech
📅 Published: 2026-10-14 | Updated: 2026-10-16

📝 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. A...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101259

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2024-54629

📊 Score: 5.2/10 (CVSS v3.1)
📦 Product: WSO2 Carbon Identity User Store Configuration UI, WSO2 Traffic Manager, WSO2 Carbon Identity User Store Configuration UI (+30 more)
🏢 Vendor: WSO2
📅 Published: 2025-06-02 | Updated: 2026-10-16

📝 A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54629

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102845

📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: sglang
🏢 Vendor: sgl-project
📅 Updated: 2026-10-16

📝 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression t...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102845

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-66133

📊 Score: 7.6/10 (CVSS v3.1)
📅 Published: 2026-08-25 | Updated: 2026-10-16

📝 A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs B...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66133

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102846

📊 Score: 7.5/10 (CVSS v3.1)
📅 Updated: 2026-10-16

📝 A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_enc...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102846

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-71774

📊 Score: 5.8/10 (CVSS v3.1)
📅 Published: 2026-09-04 | Updated: 2026-10-16

📝 A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within th...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71774

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-66134

📊 Score: 5.7/10 (CVSS v3.1)
📅 Published: 2026-08-25 | Updated: 2026-10-16

📝 BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66134

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-66808

📊 Score: 5.5/10 (CVSS v3.1)
📅 Published: 2026-08-26 | Updated: 2026-10-16

📝 A flaw was found in the ipa_getkeytab module of the community.general
Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66808

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102835

📊 Score: 4.6/10 (CVSS v3.1)
📦 Product: rdiffweb
🏢 Vendor: ikus-soft
📅 Updated: 2026-10-16

📝 Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102835

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102836

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: rdiffweb
🏢 Vendor: ikus-soft
📅 Updated: 2026-10-16

📝 Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102836

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-59592

📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: ECS
🏢 Vendor: Unknown
📅 Published: 2026-08-15 | Updated: 2026-10-16

📝 The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level acc...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59592

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2024-16641

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: Innovs HR
🏢 Vendor: Unknown
📅 Published: 2024-03-18 | Updated: 2026-10-16

📝 The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16641

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102837

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MAIO
🏢 Vendor: Unknown
📅 Updated: 2026-10-16

📝 The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-anal...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102837

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102838

📊 Score: 5.4/10 (CVSS v3.1)
📦 Product: Squeeze
🏢 Vendor: Unknown
📅 Updated: 2026-10-16

📝 The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and th...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102838

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102831

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
🏢 Vendor: paoltaia
📅 Updated: 2026-10-16

📝 The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in a...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102831

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-102830

📊 Score: 7.2/10 (CVSS v3.1)
📦 Product: GoSMTP Pro
🏢 Vendor: softaculous
📅 Updated: 2026-10-16

📝 The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible fo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102830

#cybersecurity #infosec #euvd #cve #vulnerability