34344 matches found
Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5p5-6xmx-p252. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all...
GHSA-WRR4-782V-JHWH neotoma has tenant isolation gap in relationship query endpoints
Summary The /listrelationships and /retrievegraphneighborhood endpoints call getAuthenticatedUserId confirming a valid session exists but do not pass the resolved user ID into the Supabase query as an .eq"userid", userId filter. As a result, queries return rows from all users rather than scoping ...
CVE-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...
postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module
A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...
WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin JetEngine versions = 3.8.10.2...
CVE-2026-57588
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data...
EUVD-2026-39409
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data...
WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Quotes llama versions = 3.1.5...
CVE-2026-54836 WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5...
CVE-2026-54849
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce = 1.1.11 versions...
EUVD-2026-39373
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce = 1.1.11 versions...
CVE-2026-54849 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce = 1.1.11 versions...
CVE-2026-54843 WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in MDTF = 1.3.7 versions...
EUVD-2026-39370
Unauthenticated SQL Injection in MDTF = 1.3.7 versions...
CVE-2026-54838 WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability
Subscriber SQL Injection in WC Vendors Marketplace = 2.6.8 versions...
CVE-2026-54822 WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability
Subscriber SQL Injection in SALESmanago & Leadoo = 3.11.2 versions...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.4 - Authenticated (Custom+) SQL Injection vulnerability
Authenticated Custom+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin Groundhogg versions = 4.5.4...
EUVD-2026-39347
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...
