96149 matches found
CVE-2026-63080 Aptabase SQL Injection via ClickHouse query backend
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...
GHSA-V96J-25GV-G2W9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...
CVE-2026-64880 Blind SQL Injection
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...
CVE-2026-64880
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...
dbeaver v26.1.3
DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...
CVE-2026-55084
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...
CVE-2026-55082
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...
CVE-2026-55082 DHIS2 SQL injection in SQL View filter values
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...
@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +840 more potentially affected by CVE-2026-59895 via hono (>=4.0.0, <=4.12.26)
hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.29.23 and more Source cves: CVE-2026-59895 Source advisory: OSV:GHSA-W62V-XXXG-MG59...
CVE-2026-55084 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...
EUVD-2026-46360
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...
CVE-2026-64877
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-64877
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-64877
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-64877
CVE-2026-64877 is an authenticated, non-admin SQL injection vulnerability in the appliance’s ticketing REST API that can lead to access to sensitive data stored in the appliance database. The CVSS v3.1 base score is 9.6 (CRITICAL) with network attack vector, low attack complexity, and privileges ...
Malicious code in nebulix-ai (PyPI)
Source: amazon-inspector 93ea83117b0ae362a2b55ad581d69b3600c81b78d2e90c19bb1ea9eea2266a4c The package's documented NebulixEngine.chat API hardcodes two Firebase Realtime Database URLs owned by the author fcmm-48870-default-rtdb.firebaseio.com and tappu-76693-default-rtdb.firebaseio.com as the...
Malicious code in database-roblox (PyPI)
Source: kam193 bc72e398d8a27feaf630ecd5c3f852b452ad895a1e0a104abbc87da277e3bfc4 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API wrapper. The roboat.pro later robase.app domain advertise...
Malicious code in bitcoinlib-dev (PyPI)
Source: kam193 a198ee5e2df9c67dcbd24ed19a8fec5d462bbb3c0eb474cf00cd299e75074ef5 It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to lure users seeking for help with the bitconinlib package:...
