CVE-2022-45899

Nokia Broadcast Message Center (BMC) versions prior to 13.1 are vulnerable to an OS command injection vulnerability (CVE-2022-45899). An unauthenticated remote attacker can execute arbitrary commands with root privileges by providing shell metacharacters in the Log Scanner Search Pattern field of...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8088 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8087 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8087 Source advisory: OSV:GHSA-H9RH-5FFH-H669...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8088 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8088 Source advisory: OSV:PYSEC-2026-2156...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8087 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8087 Source advisory: OSV:PYSEC-2026-2155...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8086 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8084 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8084 Source advisory: OSV:PYSEC-2026-2153...

CVE-2026-41906 FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers through the mailbox-filtered search endpoint, but the backend conversationchangecustomer action accepts any supplied...

CVE-2026-44349

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

Chromium: CVE-2026-8011 Insufficient policy enforcement in Search

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-44349

Daptin CVE-2026-44349: The fuzzy search path on /api/ accepts a user-supplied column list and interpolates it into raw SQL without a column whitelist, enabling an authenticated user to read the entire database on vulnerable versions. Affected component: processFuzzySearch in server/resource/resou...

CVE-2026-44349 Daptin fuzzy search injects unvalidated column name into raw SQL

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

CVE-2026-44349 Daptin fuzzy search injects unvalidated column name into raw SQL

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

CVE-2026-44349 Daptin fuzzy search injects unvalidated column name into raw SQL

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

CVE-2026-44349

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

CVE-2026-8063

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads...

CVE-2026-41659

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint membersassignmentdata.php includes hidden profile fields BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY in its SQL search condition regardless of field visibility settings. While the...

CVE-2026-8063 Post-auth null pointer dereference when aggregating against a view with empty search pipeline

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads...

CVE-2026-8063

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads...

CVE-2026-8063 Post-auth null pointer dereference when aggregating against a view with empty search pipeline

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads...