CVE-2026-121009

A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an...

CVE-2026-121009

The SQL::Abstract Perl module (versions 1.90_01 through 2.000001_03 ) contains a vulnerability where the injection_guard check is bypassed when providing function names via the explicit { -func => [ $name, ... ] } form. While the { -name => ... } shorthand correctly triggers the guard, the ...

EUVD-2026-116929

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

CVE-2026-121009: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

PT-2026-136981

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl skip the injection guard check for function names given with -func. injection guard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name in...

PT-2026-136006

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Extended PRO versions prior to 0.9.2.7 Description Insufficient validation of form configuration parameters before they are merged into field settings and passed to the call user func array function within the render...

vestacp-config-eval-rce

VestaCP config-parser eval sinks → root RCE VESTACP-2026-001 Security advisory for the original Vesta Control Panel VestaCP ≤ 0.9.8-26 github.com/serghey-rodin/vesta, vestacp.com — unmaintained since September 2019: the shared config parser in func/main.sh evaluates user-controllable KEY='value'...

UBUNTU-CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

Linux Distros Unpatched Vulnerability : CVE-2026-119139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119139

Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 are vulnerable to a host crash due to a leftover assertion in component::Func::call. This assertion incorrectly rejects guest exports that utilize the async ABI option. An attacker providing a component with an async-lifted export ca...

EUVD-2026-113206

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...