Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...

CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-56145

CVE-2026-56145 describes an Elasticsearch vulnerability of uncontrolled resource consumption (CWE-400) leading to denial of service via excessive memory allocation (CAPEC-130). A low-privileged authenticated user who can execute EQL sequence queries against an index they control can craft queries...

CVE-2026-64880

CVE-2026-64880 corresponds to a blind SQL injection in Tenable Security Center, caused by unsanitized user input in report filtering parameters that is concatenated into SQL queries. This can enable unauthorized database read access. The CVE is listed with a base score of 7.1 (HIGH) on CVSS v3.1/...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-55082

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...

CVE-2026-59140

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...

CVE-2026-59140 Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...

CVE-2016-20096

Linknat VOS3000/VOS2009 (up to version 2.1.2.0) is affected by an unauthenticated SQL injection in the login flow. The vulnerability occurs via the name parameter in a POST to the login endpoint, enabling arbitrary SQL execution and potential extraction of plaintext credentials and other database...

CVE-2016-20096 Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

Exploit for CVE-2026-63030

WP2Shell Detector and Validation PoC !License: MIThttps:/...

CVE-2026-15829

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

SUSE CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-39879

A flaw was found in syslog-ng. An attacker on an adjacent network can exploit a missing sanitization call in the afsqlddrunquery function, leading to a SQL injection vulnerability. This vulnerability, when the SQL driver is manually configured, can result in a denial of service and allow for...

CVE-2026-8082

CVE-2026-8082 affects the bpost-shipping-platform WordPress plugin before 3.2.3. The issue is improper sanitization of a parameter used in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin. R...