Security-Detections-MCP

Security Detections MCP Сервер MCP Model Context Protocol, позволяющий LLM запрашивать унифицированную базу данных правил обнаружения угроз Sigma , Splunk ESCU , Elastic , KQL , Sublime и CrowdStrike CQL. Впервые здесь? Начните сРуководства по установке — пошаговые инструкции для macOS, Windows W...

Query-Hub

CQL-Hub | Запросы CrowdStrike SIEM & LogScale Добро пожаловать в бэкенд-репозиторий CQL-Hub Этот репозиторий обеспечивает работу cql-hub.com: это бесплатный хаб, создаваемый сообществом , для запросов CrowdStrike Falcon SIEM. Все запросы, хранящиеся здесь, автоматически публикуются и становятся...

GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Лаборатория уязвимостей и отчет PoC Среда для практики Vulnerable Lab и подробный отчет об эксплуатации уязвимости SQL Injection Error-based в GeoServer CVE-2023-25157 и библиотеке GeoTools CVE-2023-25158. Подробный отчет об...

PYSEC-2026-4102 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRAPROJECTSFILTER and CONFLUENCESPACESFILTER environment variables, which the README documents as the...

PT-2026-105852

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRA PROJECTS FILTER and CONFLUENCE SPACES FILTER environment variables, which the README documents as...

PT-2026-78872

Уязвимость функции jsonArrayContains библиотеки GeoTools программного обеспечения для администрирования и публикации геоданных на сервере OSGeo GeoServer связана с непринятием мер по защите структуры SQL-запроса при обработке параметра CQL FILTER. Эксплуатация уязвимости может позволить нарушител...

Exploit for SQL Injection in Osgeo Geoserver

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-...

PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

PT-2026-59534

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

GHSA-Q65P-7P84-495C Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wf65-4jjx-q444. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra...

CVE-2026-60090: Improper Neutralization of Special Elements used in an SQL Command

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

CVE-2026-44337

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

CVE-2026-44337

PraisionAI across versions 2.4.1–4.6.34 exposes optional SQL/CQL-backed knowledge-store backends that derive table and index identifiers from unvalidated collection names. This can enable SQL/CQL injection when applications pass untrusted collection names into these backends. The issue is fixed i...

CVE-2026-44337: Improper Input Validation

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

EUVD-2026-23992

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values...

PYSEC-2026-2177

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588: Improper Neutralization of Special Elements used in an SQL Command

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...