CVE-2026-92198

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit th...

CVE-2026-92185

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

CVE-2026-120651

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...

CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-121585

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some...

CVE-2026-92198

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit th...

CVE-2026-92198 Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit th...

CVE-2026-92185 Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

CVE-2026-92185

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

CVE-2026-120651 CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...

CVE-2026-120651

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...

CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120635 CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some...

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some...

CVE-2026-121585 InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...

CVE-2026-121585

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...

CVE-2026-121734

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name fr...

CVE-2026-118237

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service babeld. When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access...