CVE-2026-6295: Improper Neutralization of Special Elements used in an SQL Command

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

PT-2026-95763

Name of the Vulnerable Software and Affected Versions WPGraphQL Smart Cache versions prior to 2.3.2 Description The plugin fails to require authorization or validate the caller-supplied query identifier when storing a persisted query from a request. This allows unauthenticated users to publish...

PT-2026-95871

Name of the Vulnerable Software and Affected Versions olivier-ls PHP-FTS versions prior to 1.1.3 Description A flaw in the Search Engine component allows remote attackers to perform cross-site scripting XSS by manipulating the Query argument. The issue resides within the...

CVE-2026-93956: Improper Neutralization of Input During Web Page Generation

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93760

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-93761

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...

CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

GHSA-CJGJ-2FWF-4C2W Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458

Perses , an open-source dashboard and visualization project for observability data, contains an authorization bypass on project-scoped list endpoints (e.g., /api/v1/projects/{project}/dashboards, /api/v1/datasources). An authenticated user with viewer access to one project can supply a different ...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

EUVD-2026-83266

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

EUVD-2026-83214

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...