🚨 EUVD-2026-12542
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: sjcl
📅 Updated: 2026-03-17
📝 All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12542
🚨 EUVD-2026-12536
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Agent-Zero
🏢 Vendor: frdel, agent0ai
📅 Updated: 2026-03-17
📝 A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12536
🚨 EUVD-2026-12537
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Royal Addons for Elementor – Addons and Templates Kit for Elementor
🏢 Vendor: wproyal
📅 Updated: 2026-03-17
📝 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_que...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12537
🚨 EUVD-2026-12538
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Agent-Zero
🏢 Vendor: agent0ai, frdel
📅 Updated: 2026-03-17
📝 A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carri...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12538
🚨 EUVD-2026-12534
📊 Score: 8.3/10 (CVSS v3.1)
🏢 Vendor: libucl
📅 Updated: 2026-03-17
📝 A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12534
🚨 EUVD-2026-12532
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: WowStore – Store Builder & Product Blocks for WooCommerce
🏢 Vendor: wpxpo
📅 Updated: 2026-03-17
📝 The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escap...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12532
FYI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
🚨 CRITICAL: CVE-2026-32267 in Craft CMS (4.x <4.17.6, 5.x <5.9.12) — incorrect auth allows privilege escalation to admin via shared URLs. Upgrade ASAP! Details: https://radar.offseq.com/threat/cve-2026-32267-cwe-863-incorrect-authorization-in--65bf3522 #OffSeq #CraftCMS #CVE202632267 #Vulnerability
🚨 EUVD-2026-12527
📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: easegen-admin
🏢 Vendor: taoofagi
📅 Updated: 2026-03-16
📝 A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/mo...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12527
🚨 EUVD-2026-12529
📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: Easy7 Integrated Management Platform
🏢 Vendor: Tiandy
📅 Updated: 2026-03-16
📝 A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12529
🚨 EUVD-2026-12530
📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: Easy7 Integrated Management Platform
🏢 Vendor: Tiandy
📅 Updated: 2026-03-17
📝 A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/getDevDetailedInfo of the component Endpoint. Executing a manipulation o...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12530
🚨 EUVD-2026-12531
📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: Easy7 Integrated Management Platform, Easy7 Integrated Management Platform, Easy7 Integrated Management Platform (+15 more)
🏢 Vendor: Tiandy
📅 Updated: 2026-03-17
📝 A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12531
🚨 EUVD-2026-12523
📊 Score: n/a
📦 Product: YAML::Syck
🏢 Vendor: TODDR
📅 Updated: 2026-03-16
📝 YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte allocation.
The base64 decoder could read p...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12523
🚨 EUVD-2026-12525
📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: easegen-admin
🏢 Vendor: taoofagi
📅 Updated: 2026-03-16
📝 A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yuda...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12525
Researchers warn of a data leak risk in AWS Bedrock’s AgentCore Code Interpreter. Attackers could abuse DNS queries to extract sensitive cloud data from AI environments if not properly configured.
Read: https://hackread.com/data-leak-risk-in-aws-bedrock-ai-code-interpreter/
🚨 EUVD-2026-12522
📊 Score: 5.5/10 (CVSS v3.1)
📦 Product: Oracle Linux, Oracle Linux, Oracle Linux
🏢 Vendor: Oracle Corporation
📅 Updated: 2026-03-16
📝 A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12522
🚨 EUVD-2026-12518
📊 Score: 3.8/10 (CVSS v3.1)
📦 Product: Mattermost, Mattermost
🏢 Vendor: Mattermost
📅 Updated: 2026-03-16
📝 Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12518
🚨 EUVD-2026-12516
📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: Mattermost, Mattermost
🏢 Vendor: Mattermost
📅 Updated: 2026-03-16
📝 Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12516
🚨 EUVD-2025-208773
📊 Score: n/a
📅 Updated: 2026-03-16
📝 A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208773
🚨 EUVD-2026-12520
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: Test Data Management
🏢 Vendor: ZwickRoell GmbH & Co. KG
📅 Updated: 2026-03-16
📝 ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12520
