CVE-2026-53629: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

UBUNTU-CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

GHSA-FM8P-53WW-HF6W DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

GHSA-RW77-VQ4G-X3HP phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

CVE-2026-97321

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-13016

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

EUVD-2026-86406

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883

The AWS pgcollection PostgreSQL extension versions 2.0.0 through 2.1.1 are vulnerable to a type confusion issue. An authenticated remote user can execute arbitrary code as the postgres operating system user by sending crafted SQL statements that exploit mismatched type metadata during collection ...

CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016

The ServiceNow AI Platform contains a SQL injection vulnerability that could allow an unauthenticated user to execute arbitrary SQL statements against the instance's underlying database. Successful exploitation could result in unauthorized access to, or modification of, instance data. ServiceNow ...