123051 matches found
CVE-2026-8055
creationtimestamp| type| source ---|---|--- 2026-07-15 20:35:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpl3db3ao22...
CVE-2026-45535
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as $var and SqlparserUtils.handleVariableDefaultValue inserts them with String.replace without escaping or parameterizatio...
CVE-2017-18306
creationtimestamp| type| source ---|---|--- 2026-07-15 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqpjj457ba2f...
CVE-2026-46485
creationtimestamp| type| source ---|---|--- 2026-07-15 20:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpj5fzol22x 2026-07-15 21:20:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpnlvlhdp2m...
CVE-2026-58659
creationtimestamp| type| source ---|---|--- 2026-07-15 19:49:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpikb5eaz2n...
EUVD-2026-44785
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilterdoFilter pass X-DE-TOKEN values to TokenUtils.validate, which checks only token presence and length before userBOByTokentoken uses JWT.decode without signature...
EUVD-2026-44783
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...
CVE-2026-20156
creationtimestamp| type| source ---|---|--- 2026-07-15 19:39:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphydbcrh2h 2026-07-16 00:22:54+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926799807904548 2026-07-16 13:00:30+00:00| seen|...
GHSA-JR4P-4XJH-FWVW
creationtimestamp| type| source ---|---|--- 2026-07-15 19:31:25+00:00| seen| https://gist.github.com/alon710/0bc2e259381309bd98ca630012fce3cb...
CVE-2026-50552
creationtimestamp| type| source ---|---|--- 2026-07-15 19:31:25+00:00| seen| https://gist.github.com/alon710/0bc2e259381309bd98ca630012fce3cb 2026-07-15 20:35:05+00:00| published-proof-of-concept| https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw...
CVE-2026-40501
creationtimestamp| type| source ---|---|--- 2026-07-15 19:30:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphhoez2b2u...
CVE-2026-50030
DataEase prior to 2.10.23 exposes the SQL preview path (DatasetDataApi.previewSql/previewSqlCheck) via /de2api/datasetData/previewSql, accepting PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross. The system stores decoded SQL in datasourceRequest.query and CalciteProvider.f...
CVE-2026-47996
creationtimestamp| type| source ---|---|--- 2026-07-15 19:18:57+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqpgsxznzn2j...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
CVE-2026-20296
creationtimestamp| type| source ---|---|--- 2026-07-15 19:10:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgdzh2ib22 2026-07-16 02:11:53+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqq5vdvydd2i 2026-07-16 06:26:56+00:00| seen|...
CVE-2026-12382
creationtimestamp| type| source ---|---|--- 2026-07-15 19:06:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpg52amuh22...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
CVE-2026-15895 OS command injection in jsii-diff in AWS jsii
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...