CVE-2026-55855

MariaDB Connector/Node.js is vulnerable to SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 character sets. The root cause is in PacketOutputStream.writeBufferEscape (lib/io/packet-output-stream.js), which escaped bytes ...

CVE-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

EUVD-2026-68011

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2026-81518

mongosqld in the MongoDB BI Connector contains a TLS misconfiguration: when a client certificate authority file is configured, the listener requests a client certificate during the TLS handshake but does not require it. In deployments where client certificates serve as the sole authentication mec...

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the readconfig.php process. An attacker can gain unauthorized access to sensitive system information by sending spoofed X-Forwarded-For or Client-IP HTTP headers to impersonate a trusted IP address. Remediation...

GHSA-786W-P5PM-CVGH phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

EUVD-2026-67862

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

EUVD-2026-66110

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...

org.yamcs:distribution (4.7.3), org.yamcs:yamcs-artemis (4.7.3) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.7.3)

org.yamcs:yamcs-core MAVEN version 4.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.7.3 - org.yamcs:yamcs-artemis 4.7.3 - org.yamcs:yamcs-client 4.7.3 - org.yamcs:yamcs-server...

org.yamcs:distribution (4.9.0), org.yamcs:yamcs-artemis (4.9.0) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.9.0)

org.yamcs:yamcs-core MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.9.0 - org.yamcs:yamcs-artemis 4.9.0 - org.yamcs:yamcs-client 4.9.0 - org.yamcs:yamcs-server...

org.yamcs:distribution (4.9.3), org.yamcs:yamcs-artemis (4.9.3) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.9.3)

org.yamcs:yamcs-core MAVEN version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.9.3 - org.yamcs:yamcs-artemis 4.9.3 - org.yamcs:yamcs-client 4.9.3 - org.yamcs:yamcs-server...

org.yamcs:distribution (4.10.0), org.yamcs:yamcs-artemis (4.10.0) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.10.0)

org.yamcs:yamcs-core MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.10.0 - org.yamcs:yamcs-artemis 4.10.0 - org.yamcs:yamcs-client 4.10.0 - org.yamcs:yamcs-serve...

org.yamcs:distribution (4.10.1), org.yamcs:yamcs-artemis (4.10.1) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.10.1)

org.yamcs:yamcs-core MAVEN version 4.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.10.1 - org.yamcs:yamcs-artemis 4.10.1 - org.yamcs:yamcs-client 4.10.1 - org.yamcs:yamcs-serve...

org.yamcs:distribution (4.10.2), org.yamcs:yamcs-artemis (4.10.2) +4 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.10.2)

org.yamcs:yamcs-core MAVEN version 4.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:distribution 4.10.2 - org.yamcs:yamcs-artemis 4.10.2 - org.yamcs:yamcs-client 4.10.2 - org.yamcs:yamcs-serve...

org.yamcs:yamcs-artemis (4.5.0), org.yamcs:yamcs-client (4.5.0) +2 more potentially affected by CVE-2026-55566 via org.yamcs:yamcs-core (4.5.0)

org.yamcs:yamcs-core MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.yamcs:yamcs-core and may be impacted: - org.yamcs:yamcs-artemis 4.5.0 - org.yamcs:yamcs-client 4.5.0 - org.yamcs:yamcs-server 4.5.0 - org.yamcs:yamcs-simulatio...