sqlicat

sqlicat Framework de SQL Injection em Python puro stdlib...

CVE-2026-73235: Improper Restriction of XML External Entity Reference

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity...

CVE-2026-72781: Protection Mechanism Failure

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

pt-platform__java-goof-1

Java Goof A vulnerable demo application, initially based on...

CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68172 arm64: make huge_ptep_get handled unaligned addresses

In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...

arkindex-base-worker (>=0.3.1b1, <=0.3.1rc2), labext-pkg (2.2.0) +3 more potentially affected by CVE-2026-67422 via pymdown-extensions (9.5.0)

pymdown-extensions PYPI version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1b1, =0.0.4, =0.0.130, =2023.11.4 - stuffpages 0.7.4 Source cves: CVE-2026-67422 Source advisory:...

arkindex-base-worker (>=0.3.2rc1, <=0.3.2rc3), rooster-client (0.0.1) potentially affected by CVE-2026-67422 via pymdown-extensions (9.9.0)

pymdown-extensions PYPI version 9.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.2rc1, =0.3.2rc3 - rooster-client 0.0.1 Source cves: CVE-2026-67422 Source advisory:...

arkindex-base-worker (>=0.3.1rc3, <=0.3.1rc4) potentially affected by CVE-2026-67422 via pymdown-extensions (9.6.0)

pymdown-extensions PYPI version 9.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1rc3, =0.3.1rc4 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

arkindex-base-worker (>=0.3.4rc1, <=0.3.4), mkdocs-techdocs-core (>=1.3.0, <=1.3.1) potentially affected by CVE-2026-67422 via pymdown-extensions (10.2.0)

pymdown-extensions PYPI version 10.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.4rc1, =1.3.0, =1.3.1 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

arkindex-base-worker (>=0.3.1rc5, <=0.3.1) potentially affected by CVE-2026-67422 via pymdown-extensions (9.7.0)

pymdown-extensions PYPI version 9.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1rc5, =0.3.1 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.7.0)

pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

adeso (>=0.0.1, <=0.0.4), arkindex-base-worker (>=0.3.3rc4, <=0.3.3) +4 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.0.1)

pymdown-extensions PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - adeso =0.0.1, =0.3.3rc4, =1.1.0, =1.1.0, =1.2.1, =1.0.0, =1.0.3 Source cves: CVE-2026-67422 Source advisory:...

arkindex-base-worker (>=0.3.5rc6, <=0.3.6rc5), mkdocs-techdocs-core (>=1.3.2, <=1.5.0) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.3.1)

pymdown-extensions PYPI version 10.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.5rc6, =1.3.2, =1.5.0 - mkdocs-techdocs-core-alexef 1.4.0 Source cves: CVE-2026-67422 Source...

arctic-ai (0.1.0), arkindex-base-worker (>=0.3.2rc5, <=0.3.2) potentially affected by CVE-2026-67422 via pymdown-extensions (9.9.2)

pymdown-extensions PYPI version 9.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arctic-ai 0.1.0 - arkindex-base-worker =0.3.2rc5, =0.3.2 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

arkindex-base-worker (>=0.3.5rc1, <=0.3.5rc5), saasops (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-67422 via pymdown-extensions (10.3.0)

pymdown-extensions PYPI version 10.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.5rc1, =0.1.0, =0.1.1 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

PYSEC-2026-3648 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

SummaryA user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied ...

CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

EUVD-2026-55232

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...