CVE-2026-46446

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to cpassword = '%@' in changePasswordForLogin...

WS-2017-0241

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0242

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0243

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0244

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0223

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0173

Affected versions of the package are vulnerable due to the mishandling if the logout function in IE8...

WS-2017-0246

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0240

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0221

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2016-0062

Shell injection vulnerability in Git-ls-remote before 0.2.0 allows the git url argument to be passed to the exec function without sanitisation...

Linux Distros Unpatched Vulnerability : CVE-2026-6477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server...

PT-2026-40922

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.4 PostgreSQL versions prior to 17.10 PostgreSQL versions prior to 16.14 PostgreSQL versions prior to 15.18 PostgreSQL versions prior to 14.23 Description The use of the dangerous function PQfn..., result is int=...

PT-2026-40886

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the request cancellation function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings...

PT-2026-42958

Summary A type-confusion bug in seroval ≤ 1.5.2 upstream advisory allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an authentication bypa...

PT-2026-40910

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup...

SOGo SQL injection vulnerability

SOGo is a very fast and scalable modern collaboration suite open source by Alinto. It offers calendar management, address book management, a fully functional webmail client, as well as features for resource sharing and permission handling. Versions of SOGo prior to 5.12.7 had an SQL injection...

VulnCheck KEV: CVE-2026-28517

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...

PT-2026-41207

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2 Description The endpoint "/api/v1/node-custom-function" lacks route-level authorization, which allows any authenticated user or holder of a valid API key to submit arbitrary JavaScript to the Custom JS Function...

AZL-86913 CVE-2026-8328 affecting package python3 for versions less than 3.12.9-13

The ftpcp function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv was patched to replace server-supplied PASV host addresses with the actual peer address getpeername0, ftpcp still calls parse227 directly and passes the raw attacker-controllable IP address and port t...