CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-84697 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...

The vulnerability of the enrichContext() function in the Budibase software allows a hacker to execute arbitrary code.

The vulnerability of the enrichContext function in Budibase software lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the MongoDB database management system, related to the lack of use of the assert() function, allows a attacker to trigger a service failure.

The vulnerability of the MongoDB database management system is related to the lack of use of the assert function. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the TendaTelnet() function in the /goform/telnet file of the Web UI component of the Tenda AC1206 software, which allows a hacker to gain full control over the system

The vulnerability of the TendaTelnet function in the /goform/telnet file of the Web UI component of the Tenda AC1206 networking software lies in the deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain full control over the system remotely...

PT-2026-84880

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4 Description The parse function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with ...

PT-2026-84595

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754: Improper Neutralization of Special Elements used in an SQL Command

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

The vulnerability of the JSONTaggedDecoder.decode_obj() function in the Natural Language Processing and symbolic processing library package allows a hacker to trigger a denial-of-service attack.

The vulnerability of the JSONTaggedDecoder.decodeobj function in the Natural Language Processing library for symbolic and statistical processing in NLTK is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

The vulnerability of the deleteMessages() function on the LibreChat artificial intelligence-based platform allows a violator to gain access to the ability to delete any files.

The vulnerability of the deleteMessages function on the LibreChat artificial intelligence-based platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and delete any files they desire...

Asymmetric Resource Consumption (Amplification)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification in the parseBody function, which expands dot-separated form field names into nested objects without limiting nesting depth or total object...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that diffe...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where a language key named proto or constructor in a user-supplied messages object causes writes to flow onto Object.prototype rather than the intended target...

CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function listtools of the file tools/mcptool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The...

EUVD-2026-65525

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers incomplete fix of CVE-2026-12841...

CVE-2020-12272

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:59+00:00| seen| https://t.me/hackingAttack/38673 2026-09-02 01:02:21+00:00| seen| https://t.me/hackingAttack/38673 2026-09-06 13:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/38673 2026-09-07 01:00:14+00:00|...

Deserialization of Untrusted Data

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loadmodel and loadpyfunc...

GHSA-73WF-GQ98-2V4G Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...