EUVD

A critical security vulnerability, tracked as EUVD-2026-99212, has been disclosed in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. The flaw, rated 9.8 out of 10 on the CVSS v3.1 scale, is an incorrect authorization issue that could allow attackers to execute arbitrary actions. The entry was published on October 13, 2026 and updated on October 15. Online commerce operators running these platforms are urged to review their installations and apply vendor fixes promptly.

A vulnerability catalogued as EUVD-2023-50161 affects the Linux kernel before version 6.5.4: a use-after-free bug in the ext4 filesystem code, specifically in the ext4_es_insert_extent function in fs/ext4/extents_status.c. The flaw carries a CVSS v3.1 score of 7.8 and was published in the EU vulnerability database on 16 October 2023, with a recent update keeping it visible. Admins are advised to patch to kernel 6.5.4 or later.

A critical vulnerability, EUVD-2026-99216, has been published affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source. The flaw is rated 9.1 out of 10 on the CVSS v3.1 scale and stems from improper input validation, which could allow attackers to exploit e-commerce platforms running the software. Adobe was named as the vendor, with the advisory published on 13 October 2026 and updated two days later.

A maximum-severity security flaw, tracked as EUVD-2026-100555, has been published for Adobe Experience Manager 6.5, its LTS release and the cloud service version, scoring a perfect 10.0 on the CVSS v3.1 scale. The advisory was first issued on 13 October 2026 and updated two days later. Security teams running the content management platform are urged to review the advisory and patch affected deployments.

A new vulnerability, EUVD-2026-99213, has been published affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source. The flaw is an incorrect authorization issue rated 8.3 out of 10 on the CVSS v3.1 scale, meaning it is considered high severity. The advisory was published on 13 October 2026 and updated on 15 October. Security teams running Magento-based stores are expected to review the advisory and check whether patches are available.

A new vulnerability tracked as EUVD-2026-99220 has been published affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source, with a CVSS v3.1 score of 8.7 out of 10. The flaw stems from improper input validation, a class of bug that can often allow attackers to manipulate data or trigger further exploitation. The advisory was published on 13 October 2026 and updated on 15 October, and security teams running Magento-based stores are expected to check for patches.

A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component, tracked as EUVD-2023-53908 with a CVSS score of 7.8, can be exploited for local privilege escalation. The flaw was published in September 2023 and its advisory record was recently updated, drawing renewed attention from security practitioners monitoring kernel vulnerabilities.

A vulnerability affecting util-linux versions 2.39.1 through 2.41.4 and 2.42 through 2.42.1 has been published as EUVD-2026-101304, with a CVSS v3.1 score of 7.0 out of 10. The flaw involves the SUID mechanism in the widely used collection of Linux utilities. It was published on 14 October 2026 and updated the following day. System administrators running affected versions are expected to check for patches.

A medium-severity flaw in curl, tracked as EUVD-2023-50460 and scored 6.5 out of 10 under CVSS v3.1, was published in the EU vulnerability database. The bug allows a malicious HTTP server to set 'super cookies' in curl, which are then sent back to more origins than the tool's rules normally permit, undermining cookie-scoping protections. Security watchers are sharing the advisory as curl maintains its long record of cookie-handling fixes.

A vulnerability tracked as EUVD-2026-101515, scored 6.5 out of 10 under CVSS v3.1, was published on 14 October and updated the following day. The flaw sits in DPDK's lib/vhost vhost-crypto component: an integer overflow in chain length checks, combined with missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto service. Administrators running DPDK-based virtualised crypto workloads are expected to review patch guidance.

A new vulnerability, EUVD-2026-101124, has been published affecting util-linux, the package of standard Linux system utilities. Versions 2.17 through 2.41.6 and 2.42 through 2.42.3, as well as 2.42.4, are listed as impacted. The flaw carries a CVSS v3.1 severity score of 7.0 out of 10, placing it in the high-severity range. The advisory was published on 14 October 2026 and updated the following day. System administrators running affected versions are expected to review the advisory and patch their systems.

A vulnerability tracked as EUVD-2023-50129 was disclosed in the Linux kernel before version 6.2.3, affecting the kobject path handling code in lib/kobject.c. The flaw allows an attacker with root access to trigger a race condition that produces an out-of-bounds write in fill_kobj_path. Because exploitation requires root privileges, the practical risk is limited, but the bug remains notable for kernel maintainers and security teams tracking Linux vulnerabilities.

A new vulnerability tracked as EUVD-2026-101368 with a CVSS score of 8.7 has been disclosed affecting Juniper Networks' Junos OS and Junos OS Evolved, alongside more than a dozen related products. The flaw is a reachable assertion issue in the rpd routing process that could allow a denial of service. Administrators running Juniper routing platforms are being urged to check whether their devices are affected and apply patches.

A vulnerability tracked as EUVD-2023-50137 affects the Intel IGB network driver in the Linux kernel before version 6.5.3. The flaw, located in igb_main.c, involves a buffer size that may be inadequate for frames larger than the maximum transmission unit, potentially affecting systems using Intel gigabit network hardware.

A moderate-severity vulnerability (EUVD-2023-50461, CVSS 5.3) in the curl data-transfer tool has been catalogued. The flaw concerns saving HSTS data to an excessively long file name, which could cause curl to erase the file's contents, leaving later requests without HSTS knowledge. Security trackers and automated feeds circulate the advisory, and administrators of systems relying on curl are advised to check their versions.

A medium-severity vulnerability, tracked as EUVD-2026-107574 with a CVSS score of 5.3, has been reported in itsourcecode's Online Cake Ordering System version 1.0. The flaw involves an unspecified function in one of the application's files, and details were updated in late October 2026. Security watchers are noting the disclosure, though the low score and niche product mean it is drawing limited attention so far.

A newly catalogued vulnerability, EUVD-2024-42621, affects the Linux kernel's ext4 filesystem, where a out-of-bounds condition can occur if the system.data extended attribute changes underneath the filesystem code. The flaw carries a CVSS v3.1 score of 7.8 out of 10 and is listed against Linux and more than a dozen related products. It was first published on 21 October 2024 and its record was updated on 15 October 2026, with a fix already resolved in the kernel.

A medium-severity vulnerability, EUVD-2021-34889, has been catalogued for Vyper, the Pythonic smart contract language maintained by vyperlang. Versions before 0.2.9 deploy forwarder proxies via the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE instead of the actual return data size, which can mislead calling contracts. The entry carries a CVSS v3.1 score of 6.3 out of 10 and was updated in the EUVD database.

A newly catalogued vulnerability, EUVD-2026-99171, carries a CVSS v3.1 score of 7.0 and affects Windows 11 versions 26H1 and 26H2, Windows Server 2025 and other Microsoft products. The flaw is a use-after-free bug in the Windows Search Component that allows an authorized attacker to elevate privileges. The advisory was updated on 13 October 2026.

A newly catalogued vulnerability, EUVD-2026-105306, affects curl and libcurl along with more than 170 related product listings. An HTTP proxy can trick libcurl into sending a server's credentials — including Basic passwords or Negotiate/Kerberos tickets — to the proxy itself by answering the CONNECT request. Security teams are assessing exposure across systems using the widely deployed library.

A new vulnerability, tracked as EUVD-2026-101298, was published on 14 October 2026 and updated the next day. It affects the VeraCrypt disk encryption software, versions 1.26.29 and earlier, where selected metadata IOCTL handlers contain a flaw. The issue carries a CVSS v3.1 score of 3.3 out of 10, indicating low severity, and concerns a tool widely used to encrypt disks with TrueCrypt-based security.

A new vulnerability, EUVD-2026-107814, has been recorded in Drupal's AI CKEditor module. The flaw involves improper neutralization of special elements used in a template engine, which allows code injection. It affects AI CKEditor versions from 0.0.0 onward. The advisory was updated on 22 October 2026, with no severity score assigned yet.

A vulnerability tracked as EUVD-2026-97757 has been disclosed in SourceCodester's Drug Recommendation System 1.0, scoring 5.3 out of 10 on the CVSS v3.1 scale. The weakness sits in an unknown function of a file within the application, and details were updated on 12 October 2026. Security feeds are circulating the advisory, though the vendor has not been named as having issued a fix.

A new vulnerability entry, EUVD-2026-104390, has been published affecting the Criminal Management System software by vendor vraj404, up to commit 2808d05. The flaw carries a CVSS v3.1 score of 6.9 out of 10, placing it in the medium-severity range. The advisory was updated on 19 October 2026, and details on affected components remain limited so far.

A new vulnerability, EUVD-2026-101800, has been catalogued affecting ggml's whisper.cpp speech recognition tool versions up to 1.9.4. The flaw sits in the whisper_model_load function of the model loading code and carries a CVSS v3.1 score of 2.4 out of 10, making it low severity. The entry was updated on 15 October 2026, and no exploitation is reported so far.

A new vulnerability, EUVD-2026-107575, has been catalogued for Pillow, the widely used Python imaging library maintained by python-pillow. Rated 6.3 out of 10 under CVSS v3.1, the flaw affects versions from 11.2.1 up to 13.0.0, where Arrow export incorrectly assumes image rows are tightly contiguous and reads from an incorrect memory pointer. Security teams are urged to check whether their dependencies are exposed.

A high-severity vulnerability, EUVD-2021-34890, has been catalogued against the Vyper smart contract language maintained by Vyperlang. Versions from 0.1.0b4 to before 0.3.0 carry a memory corruption bug caused by an incorrect stack tip pointer during internal function calls. The flaw carries a CVSS v3.1 score of 8.3 and affects projects compiling Ethereum contracts with the language.

A new vulnerability, EUVD-2026-104632, has been published affecting Pillow, the widely used Python imaging library. Versions 11.3.0 through 13.0.0 contain a heap use-after-free bug that triggers when libtiff rejects a tag during TIFF encoding. The flaw carries a CVSS v3.1 score of 5.9 out of 10, marking it as medium severity. It was published on 20 October 2026, and security teams running affected versions are being urged to review and patch.

A vulnerability tracked as EUVD-2026-108067 with a CVSS score of 8.8 has been disclosed in Profile Builder, a WordPress plugin by vendor Cozmoslabs. The flaw is an incorrect privilege assignment issue that allows privilege escalation, and disclosure details were updated on 22 October 2026. Administrators running the plugin are being urged to review the advisory and patch promptly.

A new vulnerability, EUVD-2026-107815, has been disclosed in Drupal's Webform REST module. The missing authorization flaw allows forceful browsing, letting attackers access resources without proper permission checks. All versions from 0.0.0 through 4.2.1 are affected. No severity score has been assigned yet, but security teams running the module are expected to review and patch their sites.

A new vulnerability, EUVD-2026-105307, has been published affecting curl's libcurl library. The flaw sits in libcurl's connection cache match function, which never considers the automatic client certificate option. As a result, a cached, already authenticated Schannel connection could be handed to a transfer intended for a different context, potentially sending requests with the wrong credentials. The entry was updated on 20 October 2026; no severity score is listed yet.

A vulnerability tracked as EUVD-2026-96748 affects the Robo Gallery WordPress plugin before version 5.2.6. The plugin failed to sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role to inject malicious code. Site administrators are advised to update to version 5.2.6 or later.

A new vulnerability, EUVD-2026-104635, has been catalogued in Pillow, the widely used Python image processing library, with a CVSS v3.1 score of 8.7. The flaw lies in APNG background disposal, which allocates the full canvas before the decompression bomb check runs, potentially enabling denial-of-service via memory exhaustion. Security teams are being urged to review affected versions.

A vulnerability classified as medium severity, scoring 5.1 out of 10 on the CVSS v3.1 scale, has been catalogued as EUVD-2026-103386. It affects the Databasement product from vendor David-Crty in versions up to and including 1.8.1, involving an undisclosed function within one of the software's files. Details remain limited, and no vendor response or patch information is yet reported.

A vulnerability tracked as EUVD-2026-96484 has been catalogued in Fabius, a product from vendor CocoBasic. The flaw is an unauthenticated local file inclusion with a CVSS v3.1 score of 8.1 out of 10, meaning attackers would not need credentials to exploit it. The entry in the EU vulnerability database was updated on 10 October 2026, and security watchers are circulating the advisory as patches or mitigations are checked.

A new vulnerability, tracked as EUVD-2026-107816, has been disclosed in the Editoria11y Accessibility Checker module for Drupal. The flaw is described as a privilege defined with unsafe actions issue, which could allow attackers to escalate their privileges. No CVSS score has been assigned yet, and details on patched versions remain limited.

A medium-to-high severity vulnerability, tracked as EUVD-2026-107556 with a CVSS score of 7.5, has been recorded for the toml-node library maintained by BinaryMuse. The flaw lets attackers trigger uncontrolled CPU consumption through unbounded-length integer literals passed to toml.parse(), potentially causing denial-of-service conditions in applications using the parser. The advisory was updated on 22 October 2026.

A vulnerability catalogued as EUVD-2025-211142 affects Astral's uv, the fast Python package manager, in versions before 0.8.22. The flaw, scored 8.7 out of 10 on CVSS v3.1, is a path traversal bug in the extraction of source distribution tar archives, where a crafted sequence of symlinks can allow files to be written outside the intended directory. Security teams are urged to update to 0.8.22 or later.

A newly catalogued vulnerability, EUVD-2026-107324, has been assigned a CVSS v3.1 score of 6.1, marking it as a medium-severity security flaw. It affects odf-kit, an open-source TypeScript and JavaScript library for generating, filling, reading and converting OpenDocument files (.odt, .ods), maintained under vendor GitHubNewbie0. Versions from 0.6.0 onward are reported to be affected. The advisory was updated on 21 October 2026.