CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

PYSEC-2026-3758

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74879

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

PYSEC-2026-3758

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

EUVD-2026-60110

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

EUVD-2026-60098

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74879

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint of openssl_encrypt_server/server.py (lines 159–175). The endpoint catches database exceptions and returns the full exception string via str(e) in the HTTP response to unauthenticated calle...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74879

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

BIT-MONGODB-2026-13068 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

BIT-GHOST-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

PT-2026-76615

openssl encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connectio...

PT-2026-76787

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive customers/inactive customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get sales details and get last sales amt, allowing an...

Ghost CMS 6.19.0 Content API SQL Injection

Ghost CMS versions 3.24.0 through 6.19.0 contain an unauthenticated SQL injection vulnerability in the Content API that can allow a remote attacker to read arbitrary information from the application's database. This proof of concept automatically discovers the Content API key and endpoint, uses...

CVE-2026-65822: Improper Neutralization of Special Elements used in an SQL Command

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...