CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

EUVD-2026-65396

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-49845

CVE-2026-49845 is a SQL injection in Apache Hive before 4.2.1 affecting the Hive Metastore's direct-SQL partition-name resolution paths. The root cause is that client-supplied partition names are embedded into SQL via string concatenation (DirectSqlUpdatePart.quoteString()) rather than bind param...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-55511

CVE-2026-55511: RCE autenticata in Yamcs StreamSQL Proof of concept non armato e documentazione tecnica per CVE-2026-55511, una vulnerabilità autenticata di iniezione di codice Java nel compilatore di espressioni aggregate di Yamcs StreamSQL...

CVE-2023-46304

CVE-2023-46304 Esecuzione di codice in modalità remota autenticata in VTiger Open Source CRM v7.5 Riepilogo Esiste una vulnerabilità nel modulo Users della versione attuale di VTiger CRM Open Source 7.5.0 che consente a un utente autenticato di scrivere ed eseguire codice PHP arbitrario in...

CVE-2026-77139

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-17548

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2019-9193

EN GenPostgresRCEExploit è uno strumento PoC progettato per sfruttare una vulnerabilità autenticata di esecuzione remota del codice RCE in alcune versioni di PostgreSQL 9.3 - 11.7. Consente agli utenti autenticati di eseguire comandi di sistema su un server di database PostgreSQL vulnerabile a...

EUVD-2026-65354

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-12878

CVE-2026-12878 affects the Codefresh platform , where an authenticated user can leverage an API endpoint to escalate privileges to Admin . The CVSS 4.0 score is 8.6 (HIGH) , with high impact on confidentiality, integrity, and availability of the vulnerable system. Attack requires high privileges ...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-77127 Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

EUVD-2026-65346

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

CVE-2026-77139 Path Traversal in extension "Mask" (mask)

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-77139

CVE-2026-77139 is a path traversal vulnerability in the Mask (mask) extension for TYPO3 . The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask m...

EUVD-2026-65337

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

EUVD-2026-65327

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-17548 Missing authorization for viewing background jobs

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-17548

Checkmk , a network monitoring platform, suffers from a missing authorization flaw that allows an authenticated user who knows the ID of a background job to view that job's status and results. The vulnerability affects versions <2.5.0p12, <2.4.0p36,