CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

EUVD-2026-57357

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied "property" field from the filter JSON is interpolated directly into a...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-68755

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

EUVD-2026-57257

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

Technical details (affected product/versions/exploitability) are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and trusted sources.

CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-68755

This CVE concerns Artifactory where a bundle writer may alter or create misleading release promotion information under certain conditions. The connected records identify Artifactory’s bundle writer as the affected component, with the underlying issue described as producing misleading release info...

CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions...

EUVD-2026-57245

A bundle writer may create misleading release promotion information under specific conditions...

PT-2026-71110

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A bundle writer may create misleading release promotion information under specific conditions. Recommendations At the moment, there is no information about a newer version that...

PT-2026-71117

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926: Missing Authorization

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-68755: Incorrect Authorization

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-44741: Improper Neutralization of Special Elements used in an SQL Command

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the id column filter in the DataObject grid. An attacker can execute arbitrary SQL commands by submitting crafted input, potentially exfiltrating or modifying all database contents. This is only exploitable if the...