PT-2026-103695

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

PT-2026-105858

Summary In SSE/HTTP transport mode, mysql mcp server constructs SseServerTransport without passing security settings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the...

CVE-2026-81809: Improper Neutralization of Special Elements used in an SQL Command

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

PT-2026-103914

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

ROS-20261001-73-0057

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

Backup Logs Periodically Is Not Supported for More Than One Database Engine per Job Object (Veeam Agents and Plug-ins)

Challenge When saving Guest Processing settings for a Veeam Agents backup job with periodic transaction log backup enabled for more than one database engine Microsoft SQL Server, Oracle, or PostgreSQL on the same job object, the following error occurs: Concurrent transaction log backup is not...

CVE-2026-103248: Improper Neutralization of Special Elements used in an SQL Command

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103690: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

PT-2026-105082

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

Rocky Linux 10.2 [CIQ] Security Update: php8.4 / php8.4-bcmath / php8.4-bcmath-debuginfo / php8.4-cli / etc Multiple Vulnerabilities (crlsa-2026_56969)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202656969 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp...

CVE-2026-62060: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_6818)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236818 advisory. golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are...

ROS-20261001-73-0056

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

Rocky Linux 8 [CIQ] Security Update: postgresql-jdbc / postgresql-jdbc-javadoc (crlsa-2024_1435)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241435 advisory. PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2024-1597 Tenable has extracted the preceding description block directly fr...

Rocky Linux 9 [CIQ] Security Update: postgresql-jdbc (crlsa-2024_1436)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20241436 advisory. PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2024-1597 Tenable has extracted the preceding description block directly fr...

Rocky Linux 9 [CIQ] Security Update: postgresql-jdbc (crlsa-2023_0318)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20230318 advisory. postgresql: SQL Injection in ResultSet.refreshRow with malicious column names CVE-2022-31197 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_6001)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246001 advisory. postgresql: PostgreSQL relation replacement during pgdump executes arbitrary SQL CVE-2024-7348 postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack...

Rocky Linux 9 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc Multiple Vulnerabilities (crlsa-2024_6020)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246020 advisory. postgresql: PostgreSQL relation replacement during pgdump executes arbitrary SQL CVE-2024-7348 postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_5927)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20245927 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 postgresql: PostgreSQL relation replacement during pgdump...