94577 matches found
PT-2026-95304
Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...
PT-2026-101676
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101564
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-17619: Improper Neutralization of Special Elements used in an SQL Command
IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
CVE-2026-77239: Improper Authorization
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...
CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...
PT-2026-95661
Name of the Vulnerable Software and Affected Versions CordysCRM versions 1.7.0 through 1.7.3 Description An authenticated user with MODULE SETTING UPDATE permissions can execute arbitrary database functions via the POST /account-pool/page endpoint. This occurs because the...
PT-2026-95648
Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg...
PT-2026-102175
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95617
Name of the Vulnerable Software and Affected Versions IBM Platform RTM affected versions not specified Description An issue exists where a remote attacker can execute specially crafted SQL statements. This allows the attacker to view, add, modify, or delete information within the back-end databas...
Oracle Database Server (September 2026 CSPU)
The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and...
CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...
NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)
According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...
Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)
According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...
PT-2026-100401
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-85878: Improper Authorization
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...
PT-2026-102167
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-102161
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-17607: Improper Neutralization of Special Elements used in an SQL Command
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...