EUVD

A medium-severity server-side request forgery flaw has been catalogued as EUVD-2026-112727 in WebToffee's Product Import Export for WooCommerce plugin. Versions 2.5.1 before 2.6.8 are affected, with a CVSS v3.1 score of 5.1 out of 10. Store owners using the popular plugin are being urged to update to 2.6.8 or later to close the flaw.

A new vulnerability, EUVD-2026-112728, has been published for VideoWhisper's Broadcast Live Video plugin, the videowhisper-live-streaming-integration. The flaw is a Missing Authorization issue rated 7.1 out of 10 on the CVSS v3.1 scale, meaning attackers could potentially perform actions without proper permission checks. The entry was updated on 29 October 2026, and users running the plugin are advised to apply patches once released.

A new vulnerability listing, EUVD-2026-113179, flags insecure permissions in Share 2 Archive Today, versionCode 61, on Android. The flaw lets unauthorized attackers arbitrarily overwrite another user's clipboard content by supplying a crafted URL. A severity score has not yet been assigned, and no patch details are available.

A new vulnerability entry, EUVD-2026-112729, has been published for the 'Login with phone number' product by vendor Hamid Alinia. The flaw is rated 8.8 out of 10 on the CVSS v3.1 scale and involves weak authentication, allowing authentication abuse. The entry was updated on 29 October 2026, and security watchers are circulating the advisory as users of the plugin may need to patch or mitigate.

A new vulnerability, EUVD-2026-111391, has been published for Microsoft Edge (Chromium-based) with a CVSS v3.1 score of 8.8. The flaw is a double free issue that could allow an unauthorized attacker to execute code over a network. It was published on 27 October 2026 and updated on 29 October 2026.

A security advisory, EUVD-2026-113180, updated on 29 October 2026, flags an insecure permissions flaw in the ContentProvider component of mhss1 MyBrain version 3.1.0. The weakness lets unauthorized attackers arbitrarily read another user's private notes, tasks and diary content. No severity score has been assigned yet, and users of the app are being urged to check for updates.

A new vulnerability tracked as EUVD-2026-112730 has been published affecting BuddyPress, the WordPress community plugin. The flaw is an SQL injection weakness rated 8.5 out of 10 under CVSS v3.1, allowing blind SQL injection attacks against affected installations. The advisory was updated on 29 October 2026, and administrators running BuddyPress are being urged to review the details and patch promptly to avoid potential data compromise.

A vulnerability tracked as EUVD-2026-113181 affects the CardProvider content provider component of the AnyMemo flashcard app, versionCode 20260730. Insecure permissions allow unauthorized attackers to arbitrarily read flashcards across a user's entire memorization database. The issue was catalogued on 29 October 2026; no severity score has been assigned yet, and it remains unclear whether a patched version is available.

A new vulnerability, EUVD-2026-111392, has been published for Microsoft Edge (Chromium-based), with a CVSS v3.1 score of 8.8 out of 10. The flaw is a type confusion issue that allows an unauthorized actor to potentially exploit the browser. The advisory was published on 27 October 2026 and updated on 29 October, and security watchers are flagging the high severity rating for users of Microsoft's browser.

A vulnerability tracked as EUVD-2026-112731 has been recorded for LearnPress, the WordPress learning management plugin by ThimPress. The flaw carries a CVSS v3.1 score of 7.5 and is described as a missing authorization issue, allowing exploitation of incorrectly configured access controls. Details on affected versions and fixes remain incomplete, prompting security teams to flag it for review.

A new vulnerability entry, EUVD-2026-112000, has been published for Dell's PowerProtect Data Domain backup appliances, rated 7.2 out of 10 under CVSS v3.1. The advisory, first published on 28 October 2026 and updated the following day, affects Feature Release version 7.7.1.0 and related Data Domain builds. Administrators running Dell backup infrastructure are being urged to check whether their deployments fall within the affected versions.

A security flaw tracked as EUVD-2026-78098, rated 5.5 out of 10 on the CVSS v3.1 scale, has been fixed across Apple's platforms. Apple addressed the issue with improved data protection, releasing patches in iOS 26.7 and iPadOS 26.7, iOS 27 and later versions. The vulnerability affected macOS, watchOS, iOS, iPadOS and several other Apple products.

A medium-severity vulnerability, tracked as EUVD-2026-106323, has been published affecting Oracle Communications Billing and Revenue Management, with a CVSS v3.1 score of 6.7 out of 10. The flaw affects multiple components of the billing platform, which telecom operators rely on for customer billing and revenue operations. Security teams are likely reviewing the advisory to assess exposure and check whether patches are available from Oracle.

A vulnerability, EUVD-2026-106329, has been disclosed in Oracle Java SE, affecting the Compiler component of supported versions. It carries a CVSS v3.1 severity score of 3.7 out of 10, marking it as low severity. The entry was published on 20 October 2026 and updated on 27 October 2026, with Oracle Corporation listed as the affected vendor.

A vulnerability tracked as EUVD-2026-113215 has been published affecting @sd-jwt/core and @sd-jwt/decode, the JavaScript packages maintained by the OpenWallet Foundation implementing the Selective Disclosure JWT specification. Versions 0.19.0 and earlier are affected, and the flaw carries a CVSS v3.1 score of 7.1 out of 10, rated high severity. The advisory record was updated on 29 October 2026. Developers using these libraries in credential or identity workflows are expected to check whether patched releases are available and update their dependencies accordingly.

A new vulnerability, tracked as EUVD-2026-113523, has been disclosed in Drupal's Domain Login Restrict module. The flaw is classified as an authentication bypass using an alternate path or channel, meaning an attacker could log in through a route the module is supposed to block. No severity score has been assigned yet, and affected versions were not fully specified in the advisory. Administrators running the module are advised to watch for a patched release and review site access controls in the meantime.

A new vulnerability, tracked as EUVD-2026-113421, has been disclosed in Google Chrome. The memory corruption flaw in the browser's MediaStream component affected versions prior to 156.0.8078.79, allowing a remote attacker to potentially read memory inside the sandbox through a crafted HTML page. Google has issued a fix in the updated release, and users are advised to update their browsers.

Google has updated Chrome to fix a use-after-free vulnerability in the browser's FileSystem component, tracked as EUVD-2026-113422. The flaw, present before version 156.0.8078.79, could have allowed a remote attacker to execute arbitrary code inside the browser's sandbox using a crafted HTML page. Security trackers flagged the update on October 30, 2026. Users are advised to update Chrome promptly.

Apple has released security updates addressing a newly catalogued vulnerability, EUVD-2026-110403, affecting macOS, iOS and iPadOS, among other products. The flaw was fixed with additional entitlement checks, with patches delivered in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, and corresponding macOS releases. No severity score has been assigned yet.

A high-severity vulnerability, tracked as EUVD-2026-110629 with a CVSS score of 8.8, has been reported in the Kirki plugin for WordPress, developed by Themeum. The flaw allows privilege escalation via PHP object injection and affects all versions up to the disclosure date. Administrators are being urged to update the plugin and review site access.

ServiceNow has remediated a sandbox escape vulnerability, tracked as EUVD-2026-113362, affecting its ServiceNow AI Platform. The flaw carries a CVSS v3.1 severity score of 9.4 out of 10, placing it in the critical range. The advisory was updated on 29 October 2026, and security teams are being urged to review whether their deployments are affected and apply the fix.

A medium-severity vulnerability, EUVD-2026-106378, has been catalogued in Oracle PeopleSoft Enterprise PeopleTools, affecting the Portal component. Rated 5.3 out of 10 under CVSS v3.1, it was published on 20 October 2026 and updated on 28 October. Security teams tracking Oracle products are being urged to check whether their PeopleTools deployments need patching.

A medium-severity vulnerability, EUVD-2026-110789, has been documented in the Redaxo content management system. Versions of the Redaxo core before 5.21.5 contain a missing authorization flaw in the rex_api_package API function, allowing non-admin backend users to manage packages with only limited privileges. The issue carries a CVSS v3.1 score of 6.1. Users are advised to update to version 5.21.5 or later to close the gap.

A vulnerability tracked as EUVD-2026-110990, a site isolation issue in the DOM Service Workers component, was updated in the EU vulnerability database on 27 October 2026. Mozilla has fixed the flaw in Firefox 159 and Firefox ESR 153.6, and users are advised to update their browsers.

A critical vulnerability, tracked as EUVD-2026-112564, has been disclosed in openEQUELLA, the open-source educational content platform maintained by the Apereo Foundation. Rated 9.4 out of 10 on the CVSS v3.1 scale, the flaw affects versions before 2026.1: the scripting engine's system.execute() function runs operating system commands without validation, allowing potential remote command execution. Administrators are being urged to review the advisory, updated 29 October 2026, and upgrade promptly.

A vulnerability tracked as EUVD-2026-112732 has been disclosed in GEO my WP, the WordPress location and mapping plugin by developer Eyal Fitoussi. The flaw, rated 7.5 out of 10 under CVSS v3.1, is a missing authorization issue that lets attackers exploit incorrectly configured access controls. Details were updated on 29 October 2026, and administrators running the plugin are advised to check for patched versions.

A new vulnerability tracked as EUVD-2026-112464 affects the Echo web framework for Go maintained by labstack. Versions before 4.16.0 and 5.4.0 trust forwarded scheme headers from any client in Context.Scheme, which can allow attackers to spoof the scheme. The flaw carries a CVSS v3.1 score of 5.9 out of 10. Users are advised to update to 4.16.0 or 5.4.0.

A newly logged vulnerability, EUVD-2026-110631, carries a moderate CVSS v3.1 score of 5.3 and affects the PayDunya WooCommerce Payment Gateway plugin for WordPress, up to and including version 1.1.6. The flaw lies in the plugin failing to verify the authenticity of incoming payment notifications, meaning attackers could potentially forge payment confirmations and receive goods or services without paying.

Apple has patched a buffer overflow flaw in macOS, tracked as EUVD-2026-110122 with a CVSS score of 4.3. The fix, addressed through improved bounds checking, is included in macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. Users are advised to update their systems to the latest versions.

A new vulnerability entry, EUVD-2026-110790, documents an insufficient session expiration issue in the core of the Redaxo CMS. Versions before 5.21.5 allow attackers to keep access to an account by maintaining an existing session after it should have expired. The flaw carries a low CVSS v3.1 severity score of 2.3 out of 10, and the advisory entry was updated on 27 October 2026.

A medium-severity vulnerability, tracked as EUVD-2026-112565 with a CVSS score of 6.1, has been disclosed in openEQUELLA, the open-source learning content management system maintained by the Apereo Foundation. Versions before 2026.1 are affected: the SOAP API's stopEdit operation parses XML with a parser that resolves external entities, allowing a potential XXE attack. Users are advised to update to 2026.1.

A newly catalogued vulnerability, EUVD-2026-111995, affects Dell's PowerProtect Data Domain Management Center and related PowerProtect Data Domain components. It carries a CVSS v3.1 severity score of 9.6 out of 10, placing it in the critical range. The entry was published on 28 October 2026 and updated the following day. Security teams are likely reviewing Dell's advisories to determine exposure and whether patches are available.

A new vulnerability, EUVD-2026-78099, has been catalogued affecting Apple's iOS, iPadOS and watchOS. Rated 7.5 out of 10 on the CVSS v3.1 scale, the flaw is described as a privacy issue fixed through improved state management. It was published in September 2026 and updated in late October, with patches delivered in iOS 26.7, iPadOS 26.7 and iOS 27. Users are advised to update their devices to stay protected.

A medium-severity vulnerability, scored 6.1 on CVSS v3.1, has been catalogued as EUVD-2026-106534 in Oracle's JD Edwards EnterpriseOne Tools, specifically the Web Runtime SEC component. The entry was published on 20 October 2026 and updated on 28 October. Security teams running JD Edwards are being urged to check the advisory and apply Oracle's patching guidance.

A high-severity vulnerability, EUVD-2026-111994, has been published affecting Dell PowerProtect Data Domain, including Feature Release versions 7.7.1.0. The flaw carries a CVSS v3.1 base score of 8.3, placing it in the high severity range. The entry was published on 28 October 2026 and updated on 29 October 2026. Administrators running Dell's backup and data protection appliances are being advised to track the advisory and apply vendor patches as they become available.

A vulnerability tracked as EUVD-2026-112566 has been disclosed in openEQUELLA, the open-source digital repository maintained by the Apereo Foundation. Versions before 2026.1 leave external entity resolution enabled in the XML parser for item metadata, which could allow a user permitted to create items to exploit the flaw. The issue carries a CVSS v3.1 score of 7.1 and records were updated on 29 October 2026.

A low-severity vulnerability, tracked as EUVD-2026-110632 with a CVSS score of 3.7, has been disclosed in TiendaCrypto para WooCommerce, a WordPress plugin used for cryptocurrency payments in online stores. Versions up to and including 1.2.1 fail to properly verify the authenticity of payment webhooks, potentially allowing forged payment confirmations. Store owners using the plugin are being advised to check for updates.

A new vulnerability, tracked as EUVD-2026-107363 and scored 6.9 out of 10 on the CVSS v3.1 scale, has been disclosed in the file-management-system-php application maintained by vendor oretnom23. The flaw affects versions up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and was published on 20 October 2026, with an update issued on 28 October. Administrators running the software are advised to check for patches or mitigations.

A medium-severity vulnerability in Oracle's JD Edwards EnterpriseOne Tools has been catalogued in the EU vulnerability database under ID EUVD-2026-106535, with a CVSS v3.1 score of 6.1 out of 10. The flaw sits in the Enterprise component of the product and was published on 20 October 2026, with an update recorded on 28 October. Oracle customers running JD Edwards environments are expected to review the advisory and apply available patches.

A medium-severity vulnerability, tracked as EUVD-2026-112567 with a CVSS score of 6.9, has been disclosed in openEQUELLA, the open-source learning repository maintained by the Apereo Foundation. Versions before 2026.1 leave the GET /api/userquery/userinfobackup endpoint without authentication or authorisation checks, potentially letting unauthenticated attackers access sensitive user backup information. Administrators are advised to update to openEQUELLA 2026.1 or later.