Adobe Connect <= 4.4 Multiple Vulnerabilities (APSB26-150)

The version of Adobe Connect installed on the remote host is prior to 4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-150 advisory. - Cross-site Scripting Reflected XSS CWE-79 potentially leading to Arbitrary code execution CVE-2026-75698 - Improper...

Linux Distros Unpatched Vulnerability : CVE-2026-48188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper Input Validation vulnerability in OTRS or OTRS Community Edition database layer module allows an unauthenticated SQL injection which can lead to an...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-65980

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-61852

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

EUVD-2026-84214

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980

Chartbrew , an open-source web application for creating charts from databases and APIs, is vulnerable to SQL injection in its ClickHouse protocol prior to version 5.2.3 . The root cause is that applySqlVariables() is called without the escapeBackslash option, allowing an attacker to supply a back...

CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

EUVD-2026-84213

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61852

Chartbrew (open-source charting web app) prior to 5.2.2 is vulnerable to SQL injection in its AI runQuery() tool (server/modules/ai/orchestrator/tools/runQuery.js). The row_limit parameter is interpolated into a SQL LIMIT clause without integer validation; because the read-only keyword check exec...

CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

EUVD-2026-84212

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

SUSE CVE-2026-59834

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNI...

SUSE CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

SUSE CVE-2026-69084

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...