Skip to content

Commit f2b5080

Browse files
aboutcode-automationaboutcode-automation
committed
Sync EUVD catalog: Wed Apr 29 00:47:16 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent f4c8103 commit f2b5080

223 files changed

Lines changed: 8400 additions & 1 deletion

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/2026/04/EUVD-2024-55558.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2024-55558",
3+
"enisaUuid": "7dd0b5bb-8e45-327f-a66a-e212837634fa",
4+
"description": "Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests,\u00a0causing a service disruption. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.",
5+
"datePublished": "Apr 28, 2026, 6:51:33 AM",
6+
"dateUpdated": "Apr 28, 2026, 6:51:33 AM",
7+
"baseScore": 5.3,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
10+
"references": "https://www.hanwhavision.com/wp-content/uploads/2026/04/Camera-Vulnerability-ReportCVE-2024-5401154013.pdf\n",
11+
"aliases": "CVE-2024-54011\n",
12+
"assigner": "Hanwha_Vision",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "28f574d7-49e0-31d8-8d3b-aa20e85d804c",
17+
"product": {
18+
"name": "QND-8080R"
19+
},
20+
"product_version": "0 <2.24.00"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "7396b8be-0e79-3512-bacf-35f7972cc5f6",
26+
"vendor": {
27+
"name": "Hanwha Vision"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2024-55559.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2024-55559",
3+
"enisaUuid": "48c30473-7719-3928-b3b5-1d8c008e451a",
4+
"description": "Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to the manufacturer's report for details and workarounds.",
5+
"datePublished": "Apr 28, 2026, 7:03:58 AM",
6+
"dateUpdated": "Apr 28, 2026, 7:03:58 AM",
7+
"baseScore": 8.5,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.hanwhavision.com/wp-content/uploads/2026/04/Camera-Vulnerability-ReportCVE-2024-5401154013.pdf\n",
11+
"aliases": "CVE-2024-54012\n",
12+
"assigner": "Hanwha_Vision",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "0d182bb7-f435-3926-894c-5f6e34852456",
17+
"product": {
18+
"name": "QND-8080R"
19+
},
20+
"product_version": "0 <2.24.00"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "c431a01b-0441-3bd2-aa92-af275d320298",
26+
"vendor": {
27+
"name": "Hanwha Vision"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2024-55560.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2024-55560",
3+
"enisaUuid": "b7e1eedd-d382-3b8e-b1e2-485ed26652aa",
4+
"description": "Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds",
5+
"datePublished": "Apr 28, 2026, 7:06:17 AM",
6+
"dateUpdated": "Apr 28, 2026, 7:06:17 AM",
7+
"baseScore": 8.7,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.hanwhavision.com/wp-content/uploads/2026/04/Camera-Vulnerability-ReportCVE-2024-5401154013.pdf\n",
11+
"aliases": "CVE-2024-54013\n",
12+
"assigner": "Hanwha_Vision",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "b5f9ca02-6883-3f54-a714-b95b23087425",
17+
"product": {
18+
"name": "QND-8080R"
19+
},
20+
"product_version": "0 <2.24.00"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "4c0f685f-745c-36d0-a59b-3d84738b4eb9",
26+
"vendor": {
27+
"name": "Hanwha Vision"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2025-209580.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209580",
3+
"enisaUuid": "3208ac04-d75a-3bb4-a1b4-52cbd4df63a6",
4+
"description": "Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.",
5+
"datePublished": "Apr 28, 2026, 7:52:23 AM",
6+
"dateUpdated": "Apr 28, 2026, 7:52:23 AM",
7+
"baseScore": 0.0,
8+
"references": "https://r.sec-consult.com/desktime\nhttps://desktime.com/download\n",
9+
"aliases": "CVE-2025-10539\n",
10+
"assigner": "SEC-VLab",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "4953a77b-bede-32c3-a8e1-029beada3c48",
15+
"product": {
16+
"name": "DeskTime Time Tracking App"
17+
},
18+
"product_version": "0 <1.3.674"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "2d7cc0f9-421c-3e67-b265-8c4f60a2289c",
24+
"vendor": {
25+
"name": "DeskTime"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209581.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209581",
3+
"enisaUuid": "08860d1a-54e7-392b-b5d5-aaccc3e19d06",
4+
"description": "Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.\n\nDescription: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal \"free(): invalid pointer\" error message.",
5+
"datePublished": "Apr 28, 2026, 9:11:44 AM",
6+
"dateUpdated": "Apr 28, 2026, 9:50:39 AM",
7+
"baseScore": 0.0,
8+
"references": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql\n",
9+
"aliases": "CVE-2025-48431\n",
10+
"assigner": "apache",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "ed526a38-1d33-3a8c-a0eb-bd61dc520cdc",
15+
"product": {
16+
"name": "Apache Thrift"
17+
},
18+
"product_version": "0 <0.23.0"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "df885d76-036a-3222-8a3d-e2068afc438c",
24+
"vendor": {
25+
"name": "Apache Software Foundation"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209582.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2025-209582",
3+
"enisaUuid": "7873005d-b373-3724-bcab-7fae1f5fae20",
4+
"description": "An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to reference tampering, where Cista does not perform sufficient checks to safeguard against self-referencing pointers and referencing other data within the payload. The leak occurs if the deserialized values are observable by the attacker.",
5+
"datePublished": "Apr 28, 2026, 12:00:00 AM",
6+
"dateUpdated": "Apr 28, 2026, 3:09:31 PM",
7+
"baseScore": 5.3,
8+
"baseScoreVersion": "3.1",
9+
"baseScoreVector": "CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N",
10+
"references": "http://cista.com\nhttps://gist.github.com/TrebledJ/66cc0ed37bdb3e70ce0ef98396790771\n",
11+
"aliases": "CVE-2025-60887\n",
12+
"assigner": "mitre",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "94f9e49e-217a-3ba1-a51c-8a74d0a09ea3",
17+
"product": {
18+
"name": "n/a"
19+
},
20+
"product_version": "n/a"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "1c1a1f65-8081-3913-9ad5-1e0e6a40810f",
26+
"vendor": {
27+
"name": "n/a"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2025-209583.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"id": "EUVD-2025-209583",
3+
"enisaUuid": "9a97962e-4695-3fad-a3cc-d8d1f48286ec",
4+
"description": "Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.",
5+
"datePublished": "Apr 28, 2026, 12:00:00 AM",
6+
"dateUpdated": "Apr 28, 2026, 3:16:37 PM",
7+
"baseScore": 0.0,
8+
"references": "http://hpx.com\nhttp://stellargroup.com\nhttps://gist.github.com/TrebledJ/b32fd5c469583493ab50244045c9a6e4\n",
9+
"aliases": "CVE-2025-60889\n",
10+
"assigner": "mitre",
11+
"epss": 0.0,
12+
"enisaIdProduct": [
13+
{
14+
"id": "f32f8d06-314c-3708-8da4-61fa1925d50c",
15+
"product": {
16+
"name": "n/a"
17+
},
18+
"product_version": "n/a"
19+
}
20+
],
21+
"enisaIdVendor": [
22+
{
23+
"id": "f5dfdffc-18d2-3a34-9d0f-8f9456384d5d",
24+
"vendor": {
25+
"name": "n/a"
26+
}
27+
}
28+
]
29+
}

‎advisories/2026/04/EUVD-2025-209585.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2025-209585",
3+
"enisaUuid": "ab6d5584-0100-3b26-8255-c2b353a129a0",
4+
"description": "The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.",
5+
"datePublished": "Apr 28, 2026, 12:00:00 AM",
6+
"dateUpdated": "Apr 28, 2026, 3:56:56 PM",
7+
"baseScore": 7.5,
8+
"baseScoreVersion": "3.1",
9+
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
10+
"references": "https://docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.html\nhttps://arandasoft.com/en/productos/aranda-service-management/\nhttps://github.com/brandonperezlara/CVE-2025-67223\n",
11+
"aliases": "CVE-2025-67223\n",
12+
"assigner": "mitre",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "34bcc1b6-8a54-3014-88ea-9816cf2dd0cf",
17+
"product": {
18+
"name": "n/a"
19+
},
20+
"product_version": "n/a"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "b374d58f-26b9-3721-83c2-2c892cceecd5",
26+
"vendor": {
27+
"name": "n/a"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2026-25960.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2026-25960",
3+
"enisaUuid": "8fff7e96-93af-3baa-a471-dae326051ded",
4+
"description": "A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.",
5+
"datePublished": "Apr 28, 2026, 12:00:23 AM",
6+
"dateUpdated": "Apr 28, 2026, 12:00:23 AM",
7+
"baseScore": 9.3,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
10+
"references": "https://vuldb.com/vuln/359803\nhttps://vuldb.com/vuln/359803/cti\nhttps://vuldb.com/submit/801528\nhttps://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_322/README.md\nhttps://www.totolink.net/\n",
11+
"aliases": "CVE-2026-7203\n",
12+
"assigner": "VulDB",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "99e4c251-0f06-335c-a6a3-7c6c650febfa",
17+
"product": {
18+
"name": "A8000RU"
19+
},
20+
"product_version": "7.1cu.643_b20200521"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "47dac9c1-0dbf-360a-9c9c-a294e04bcc2d",
26+
"vendor": {
27+
"name": "Totolink"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2026-25961.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2026-25961",
3+
"enisaUuid": "82418276-3472-3cf8-a088-c97cac9d1bb6",
4+
"description": "A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
5+
"datePublished": "Apr 28, 2026, 12:15:15 AM",
6+
"dateUpdated": "Apr 28, 2026, 12:15:15 AM",
7+
"baseScore": 9.3,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
10+
"references": "https://vuldb.com/vuln/359804\nhttps://vuldb.com/vuln/359804/cti\nhttps://vuldb.com/submit/801530\nhttps://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_323/README.md\nhttps://www.totolink.net/\n",
11+
"aliases": "CVE-2026-7204\n",
12+
"assigner": "VulDB",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "2f406f17-7f11-38e8-bbea-9e24de0b98d9",
17+
"product": {
18+
"name": "A8000RU"
19+
},
20+
"product_version": "7.1cu.643_b20200521"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "3b9982b7-e16b-3c64-8ca4-f500f726cd5a",
26+
"vendor": {
27+
"name": "Totolink"
28+
}
29+
}
30+
]
31+
}

0 commit comments

Comments
 (0)