32727 matches found
EUVD-2026-101531
e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...
CVE-2026-55572
The e107 content management system (CMS) is vulnerable to SQL injection in versions prior to 2.3.7 . The issue exists within the bundled alt_auth plugin 's otherdb and e107db authentication backends. Specifically, the login() methods in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_...
CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...
CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...
CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...
CVE-2026-42093
The Redash data visualization package (versions after 8.0.0 until 26.9.0 ) is vulnerable to SQL Injection in the Query Results query runner located in redash/query_runner/query_results.py. The flaw occurs because the system accepts param_query_N_{key=value} parameters and passes attacker-controll...
CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...
CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...
CVE-2023-25813-TEST
CVE Test App An Express + MySQL practice app for locally verifying the behavior of Sequelize CVE-2023-25813. This project intentionally maintains a vulnerable Sequelize version and a vulnerable login query pattern. Do not expose it to the internet; run it only in a local Docker practice...
CVE-2026-102023
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured...
CVE-2026-56096
CVE-2026-56096: Solr Query Injection & Blind Data Extraction in TYPO3 EXT:solr An architectural security vulnerability was discovered in the official TYPO3 Apache Solr extension EXT:solr / apache-solr-for-typo3/solr. The issue allows unauthenticated remote attackers to inject arbitrary Solr/Lucen...
CVE-2026-102023
Junos OS Evolved is affected by a Reachable Assertion vulnerability in the fwstatsd component. This flaw allows an authenticated network attacker to trigger a denial of service (DoS) by performing an SNMP firewall-counter MIB query on a system where at least one firewall counter is configured. No...
CVE-2026-102023 Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured...
CVE-2024-3408-dtale
CVE-2024-3408 - D-Tale Authentication Bypass & RCE Reproducible lab environment for CVE-2024-3408, an authentication bypass and remote code execution vulnerability in D-Tale. Vulnerability D-Tale versions up to 3.15.1 are vulnerable due to: 1. Hardcoded SECRETKEY "Dtale" for Flask session signing...
Cortex XSOAR: OS Command Injection Vulnerability
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. Work around: Customers who are unable to upgrade immediately can mitigate this issue by disablin...
Important: Red Hat Security Advisory: python36:3.6 security update
An update for the python36:3.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection
A flaw was found in the GridFS component of the MongoDB Python Driver pymongo. The driver can treat a caller-supplied structured file identifier as a MongoDB query condition instead of a literal identifier. An authenticated user who can influence the identifier passed to GridFS download, delete, ...
CVE-2026-73796
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...