95221 matches found
CVE-2026-73392
Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-23933
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...
UBUNTU-CVE-2026-23937
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...
Akamai Valkey Managed Database: Real-Time Memory for Enterprise AI
Introducing Akamai Valkey Managed Database: a low-latency, in-memory data layer to optimize AI inference costs, accelerate RAG, and power real-time AI agents...
The Vulners team has released an updated version Getsploit
The Vulners team has released an updated version ofGetsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode search queries are executed on the Vulners server and a fully offline mode exploit data from Vulners is downloaded to a...
CVE-2026-23933
In Zabbix 7.4 , a cryptographic key used for signing Frontend sessions was erroneously written to the database seed. This vulnerability specifically impacts deployments utilizing both SAML authentication and guest users , where the key can be used to forge valid session cookies, potentially leadi...
EUVD-2026-60616
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...
CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...
CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...
CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...
CVE-2026-75853
The com.arcadedb:arcadedb-gremlin plugin (≤26.7.3) enforces SASL PLAIN authentication but skips authorization: it never calls canAccessToDatabase or binds the principal, so any valid credential can read, write, and drop data in any database via a traversal-source alias, bypassing all per-type/rea...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75844
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...
EUVD-2026-60608
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...
CVE-2026-75844
ArcadeDB versions before 26.8.1 have an SSRF flaw in the IMPORT DATABASE command: the security validator checks the hostname once, but the actual connection re-resolves the raw URL and follows redirects, allowing authenticated attackers to bypass validation via DNS rebinding or HTTP redirects to ...
CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...
CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...