Skip to content

Commit c9b1a01

Browse files
aboutcode-automationaboutcode-automation
committed
Sync EUVD catalog: Tue Apr 14 00:41:54 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent fd0f163 commit c9b1a01

226 files changed

Lines changed: 8853 additions & 27 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/2026/04/EUVD-2025-209409.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209409",
3+
"enisaUuid": "0cfeb815-9dbc-3265-84e0-2b0b48cfb6b6",
4+
"description": "The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the \"MySQL Mapping\" feature is in use, which could make SQL Injection attacks possible in certain contexts.",
5+
"datePublished": "Apr 13, 2026, 9:31:33 AM",
6+
"dateUpdated": "Apr 13, 2026, 9:31:33 AM",
7+
"baseScore": 0.0,
8+
"references": "https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-15441\n",
9+
"aliases": "CVE-2025-15441\nGHSA-5h3p-j6gw-765v\n",
10+
"assigner": "WPScan",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "386149c3-ac48-3bd6-a18d-b09a7be679f6",
15+
"product": {
16+
"name": "Form Maker by 10Web"
17+
},
18+
"product_version": "0 <1.15.38"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "a9ff8ff0-162a-3201-8b35-fbde09a34078",
24+
"vendor": {
25+
"name": "Unknown"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209411.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"id": "EUVD-2025-209411",
3+
"enisaUuid": "a122bf7b-a7b1-36b8-9621-a69a26cea143",
4+
"description": "A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.0 is recommended to address this issue. The name of the patch is 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
5+
"datePublished": "Apr 13, 2026, 12:31:15 PM",
6+
"dateUpdated": "Apr 13, 2026, 12:31:15 PM",
7+
"baseScore": 5.1,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
10+
"references": "https://vuldb.com/vuln/356967\nhttps://vuldb.com/vuln/356967/cti\nhttps://vuldb.com/submit/782265\nhttps://github.com/AnalogyC0de/public_exp/issues/28\nhttps://github.com/1Panel-dev/MaxKB/pull/4578\nhttps://github.com/1Panel-dev/MaxKB/commit/7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8\nhttps://github.com/1Panel-dev/MaxKB/releases/tag/v2.5.0\nhttps://github.com/1Panel-dev/MaxKB/\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-15632\n",
11+
"aliases": "GHSA-jx24-j485-cqwm\nCVE-2025-15632\n",
12+
"assigner": "VulDB",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "0ee4d473-b2d9-3944-b3e4-ba2134ce7440",
17+
"product": {
18+
"name": "MaxKB"
19+
},
20+
"product_version": ""
21+
},
22+
{
23+
"id": "7b2068de-0158-3491-a7c6-d562a6a26214",
24+
"product": {
25+
"name": "MaxKB"
26+
},
27+
"product_version": "2.4.0"
28+
},
29+
{
30+
"id": "b210d7ba-0cd6-3d7a-9247-4367d09fc801",
31+
"product": {
32+
"name": "MaxKB"
33+
},
34+
"product_version": "2.4.2"
35+
},
36+
{
37+
"id": "fc0ad9f0-1a47-3cff-a43a-7678f4b67b49",
38+
"product": {
39+
"name": "MaxKB"
40+
},
41+
"product_version": "2.4.1"
42+
}
43+
],
44+
"enisaIdVendor": [
45+
{
46+
"id": "24d4dee9-7cc0-30ea-b5ac-75aae14a4fc2",
47+
"vendor": {
48+
"name": "1Panel-dev"
49+
}
50+
}
51+
]
52+
}

‎advisories/2026/04/EUVD-2025-209413.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209413",
3+
"enisaUuid": "801a4bf5-62a3-3a07-a00a-0b8d845617e9",
4+
"description": "Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now described in more detail. Users concerned with role isolation and following the Airflow security model of Airflow are advised to upgrade to Airflow 3.2, where several security improvements have been implemented. They should also read and follow the relevant documents to make sure that their deployment is secure enough. It also clarifies that the Deployment Manager is ultimately responsible for securing your Airflow deployment. This had also been communicated via Airflow 3.2.0 Blog announcement [4].\n\n[1] Security Model: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html \n[2] Workload isolation: https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html \n[3] JWT Token authentication: https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html \n[4] Airflow 3.2.0 Blog announcement: https://airflow.apache.org/blog/airflow-3.2.0/ \n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue.",
5+
"datePublished": "Apr 13, 2026, 3:31:42 PM",
6+
"dateUpdated": "Apr 13, 2026, 3:31:42 PM",
7+
"baseScore": 0.0,
8+
"references": "https://github.com/apache/airflow/pull/58662\nhttps://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66236\n",
9+
"aliases": "CVE-2025-66236\nGHSA-j86x-fwp2-qh7v\n",
10+
"assigner": "apache",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "02315395-e193-30b9-bd81-0fb89ff4a818",
15+
"product": {
16+
"name": "Apache Airflow"
17+
},
18+
"product_version": "3.0.0 <3.2.0"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "0ca1af91-e993-39d2-b343-4248be93edf7",
24+
"vendor": {
25+
"name": "Apache Software Foundation"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209415.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209415",
3+
"enisaUuid": "6ced4642-26a7-38f1-9a6c-1cb7c27a10a9",
4+
"description": "A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.",
5+
"datePublished": "Apr 13, 2026, 6:30:40 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:41 PM",
7+
"baseScore": 0.0,
8+
"references": "https://www.gonitro.com/\nhttps://jeroscope.com/advisories/2025/jero-2025-015/\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66769\n",
9+
"aliases": "CVE-2025-66769\nGHSA-hf73-7qvc-m78v\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "5b319aab-d98a-3e91-a6c3-72cc922c8cd1",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "4b7426a7-6f81-378b-8add-0be1e53ed290",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209417.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209417",
3+
"enisaUuid": "8cd68eab-a1a5-3eb3-ad7f-cd6084b39726",
4+
"description": "Nitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, app.alert(app.activeDocs, true) when app.activeDocs is null), the engine routes the call through a fallback path intended for non-string arguments. In this path, js_ValueToString() is invoked on the null value and returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation. Dereferencing this pointer leads to an access violation and application crash when opening a crafted PDF.",
5+
"datePublished": "Apr 13, 2026, 6:30:40 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:41 PM",
7+
"baseScore": 0.0,
8+
"references": "http://nitro.com\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-69624\n",
9+
"aliases": "CVE-2025-69624\nGHSA-rrjx-h7jp-ggmg\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "00f3e947-c5bb-3951-82d9-61b08c54892d",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "9809c240-4058-3285-9599-095c505d35d0",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209419.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209419",
3+
"enisaUuid": "3697b93a-24db-3608-9844-fd21e8acc5df",
4+
"description": "Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.",
5+
"datePublished": "Apr 13, 2026, 6:30:40 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:41 PM",
7+
"baseScore": 0.0,
8+
"references": "http://nitro.com\nhttps://jeroscope.com/advisories/2025/jero-2025-016/\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-69627\n",
9+
"aliases": "CVE-2025-69627\nGHSA-phj3-hcm2-mjhc\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "5e7f7c5d-fb50-3c6f-8909-ea8f767dd179",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "7e54993e-419c-33a2-92c2-49dfe74702d6",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209421.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2025-209421",
3+
"enisaUuid": "54bb149c-3bc5-3683-956b-cd6cedb92b87",
4+
"description": "Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.\u00a0 This vulnerability is fixed in 5.1.7.",
5+
"datePublished": "Apr 13, 2026, 6:30:40 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:40 PM",
7+
"baseScore": 6.8,
8+
"baseScoreVersion": "3.1",
9+
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
10+
"references": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130138\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-31991\n",
11+
"aliases": "CVE-2025-31991\n",
12+
"assigner": "HCL",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "70fd3b97-4d0f-3ce6-a1ed-b867e69b6f9e",
17+
"product": {
18+
"name": "Velocity"
19+
},
20+
"product_version": "<.5.1.7"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "ffdef75b-5c18-3952-a09e-6202bd8e489b",
26+
"vendor": {
27+
"name": "HCLSoftware"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2025-209423.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209423",
3+
"enisaUuid": "c61dea9f-3676-3e3f-a5d0-0be0917d986f",
4+
"description": "Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via \"Name\" and \"Surname\" fields. The JavaScript code is executed whenever \"Activity Report\" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's \"Display Name\" is not set. The vulnerability is fixed in v8.3.2.",
5+
"datePublished": "Apr 13, 2026, 6:30:40 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:40 PM",
7+
"baseScore": 0.0,
8+
"references": "http://grokability.com\nhttp://snipe-it.com\nhttps://github.com/grokability/snipe-it/commit/b6d397bcca4e8a05176b782de769d7160058bfc4#diff-7fe056d76c09808dac923c4639161d587c3fff281a01122f3e10c4a781674a65\nhttps://github.com/mikust/CVEs/tree/main/CVE-2025-63743\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-63743\n",
9+
"aliases": "CVE-2025-63743\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "1ac64952-29cb-31a2-8eb3-aa4aa06e27a5",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "a91fa3d4-60b2-3256-aa54-80b353b473d8",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209425.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"id": "EUVD-2025-209425",
3+
"enisaUuid": "dcf0f9ea-55f9-30e6-af33-b1df7a48a120",
4+
"description": "A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation.\u00a0\n\n\n\n\nThe System 800xA IEC61850 Connect is not affected. Note: This vulnerability does not impact on the overall availability and functionality of the S+ Operations node, only the 61850 communication function.\n\n\u00a0 \u00a0\n\n\n\nThis issue affects AC800M (System 800xA):\u00a0from 6.0.0x through 6.0.0303.0, from 6.1.0x through 6.1.0031.0, from 6.1.1x through 6.1.1004.0, from 6.1.1x through 6.1.1202.0, from 6.2.0x through 6.2.0006.0; Symphony Plus SD Series: A_0, A_1, A_2.003, A_3.005, A_4.001, B_0.005; Symphony Plus MR (Melody Rack): from 3.10 through 3.52; S+ Operations: 2.1, 2.2, 2.3, 3.3.",
5+
"datePublished": "Apr 13, 2026, 6:30:42 PM",
6+
"dateUpdated": "Apr 13, 2026, 6:30:42 PM",
7+
"baseScore": 7.1,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://search.abb.com/library/Download.aspx?DocumentID=7PAA020125&LanguageCode=en&DocumentPartId=&Action=Launch\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-3756\n",
11+
"aliases": "CVE-2025-3756\n",
12+
"assigner": "ABB",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "15226a46-3f8a-3cc7-a538-adb36f020534",
17+
"product": {
18+
"name": "AC800M (System 800xA)"
19+
},
20+
"product_version": "6.1.0x \u22646.1.0031.0"
21+
},
22+
{
23+
"id": "367445ad-ba1a-3a5b-8a69-254eac2bd80f",
24+
"product": {
25+
"name": "AC800M (System 800xA)"
26+
},
27+
"product_version": "6.1.1x \u22646.1.1004.0"
28+
},
29+
{
30+
"id": "65f7cafb-0171-3593-8bbb-400f338079d2",
31+
"product": {
32+
"name": "AC800M (System 800xA)"
33+
},
34+
"product_version": "6.2.0x \u22646.2.0006.0"
35+
},
36+
{
37+
"id": "8a3cded7-2136-36ac-84cc-3f0e870ecc89",
38+
"product": {
39+
"name": "AC800M (System 800xA)"
40+
},
41+
"product_version": "6.0.0x \u22646.0.0303.0"
42+
},
43+
{
44+
"id": "b8ba3562-9d5f-369e-a6f9-e9b822bc34a6",
45+
"product": {
46+
"name": "AC800M (System 800xA)"
47+
},
48+
"product_version": "6.1.1x \u22646.1.1202.0"
49+
}
50+
],
51+
"enisaIdVendor": [
52+
{
53+
"id": "ef9aec72-0217-3397-a18a-9884e4eeb87f",
54+
"vendor": {
55+
"name": "ABB"
56+
}
57+
}
58+
]
59+
}

‎advisories/2026/04/EUVD-2025-209427.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209427",
3+
"enisaUuid": "db51927e-48f5-317d-b7b8-379aab16bd64",
4+
"description": "In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.",
5+
"datePublished": "Apr 13, 2026, 9:30:44 PM",
6+
"dateUpdated": "Apr 13, 2026, 9:30:44 PM",
7+
"baseScore": 0.0,
8+
"references": "https://github.com/12T40910/CVE/issues/12\nhttps://medium.com/@tanushkushtk01/cve-2025-51414-unrestricted-file-upload-in-online-course-registration-v3-1-bd8b839be1d7\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-51414\n",
9+
"aliases": "CVE-2025-51414\nGHSA-92r2-m39q-3xf6\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "8f6c48fa-e5a1-3358-aaf2-4d5066cfc1d5",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "27cb49eb-a737-3d7b-bb38-acd59d97bba4",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

0 commit comments

Comments
 (0)