15541 matches found
CVE-2026-55858
MariaDB Connector/J (org.mariadb.jdbc:mariadb-java-client) is vulnerable to a charset-confusion mismatch in versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The connector assumes a UTF-8 connection character set for protocol encoding/decoding and client-side escaping. If the server reports a mi...
EUVD-2026-68021
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...
CVE-2026-55858 MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...
EUVD-2026-68011
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
CVE-2026-76798
The MongoSQL Transition Readiness Tool (part of MongoDB's SQL/BI Connector stack) writes query text and user names from BI Connector log files into its generated HTML reports without encoding them for the HTML output context. An attacker with low privileges who can issue queries through the BI Co...
CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...
CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...
MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...
CVE-2026-76794
MongoSQL Transition Readiness Tool (part of the MongoDB BI Connector) contains an improper HTML encoding flaw when processing database metadata. A MongoDB user with write access can inject crafted metadata that, when another user generates and opens the Transition Readiness Report, may cause scri...
EUVD-2026-67873
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
PT-2026-83274
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2026-40018
None None None No publicly available exploits are known...
CVE-2026-82249: Improper Encoding or Escaping of Output
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...
CVE-2026-55891: Improper Encoding or Escaping of Output
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...
PT-2026-83276
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...
MiracleLinux 9 : golang-1.26.7-1.el9_8 (AXSA:2026-1689:09)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1689:09 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...