CVE-2026-103649: Synchronous Access of Remote Resource without Timeout

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

VulnCheck KEV: CVE-2023-22894

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue...

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue...

CVE-2026-76275

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...

CVE-2026-107352

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-76275

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 , an improper authorization vulnerability exists in the REST API . Users lacking "admin" or "power" roles can access search query text and job metadata—including job identifiers, dispatch parameters, result counts, and execut...

EUVD-2026-94627

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...

CVE-2026-76275 Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...

CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-107352

The Amazon Athena engine version 3 contained a vulnerability due to missing authorization checks in request handling. This flaw could have allowed an authenticated user to read limited query metadata , specifically AWS account identifiers and SQL statement text , from other AWS accounts. The vuln...

joern

Base de datos de consultas de Joern "Joern-Scan" Esta es la base de datos central de consultas para la plataforma de análisis de código abierto Joern. Tiene dos propósitos: Proporciona las baterías necesarias para convertir Joern en una herramienta de escaneo de código lista para usar. Sus...

GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

EUVD-2026-94522

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

Malicious code in @ikyyjee/ikyysinggle (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

EUVD-2026-94282

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

CVE-2026-103668

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type . This flaw could enable an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product. No specific exploit information or remediation versions are provided in the documents.