CVE-2026-60090: Improper Neutralization of Special Elements used in an SQL Command

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

Cassandra Native Protocol Detection

Detects Cassandra via CQL native protocol OPTIONS/SUPPORTED handshake. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cassandra CQL native protocol on TCP 9042.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.cassandra.detectors...

info.cqframework:elm-fhir (>=1.5.5, <=1.5.7), org.opencds.cqf.cql.ls:cql-ls (>=1.5.3, <=1.5.4) +1 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir =1.5.5, =1.5.3, =1.5.3, =1.5.4 Source cves:...

info.cqframework:elm-fhir (1.5.4), org.opencds.cqf.cql.ls:cql-ls (1.5.2) +1 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir 1.5.4 - org.opencds.cqf.cql.ls:cql-ls 1.5.2 -...

info.cqframework:elm-fhir (>=1.5.5, <=1.5.7), org.opencds.cqf.cql.ls:cql-ls (>=1.5.3, <=1.5.4) +1 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir =1.5.5, =1.5.3, =1.5.3, =1.5.4 Source cves:...

info.cqframework:cqf-fhir (>=1.5.10, <=1.5.12), info.cqframework:elm-fhir (>=1.5.8, <=1.5.12) +4 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.15)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.15 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:cqf-fhir =1.5.10, =1.5.8, =1.5.6, =1.5.7, =1.5.7, =1.5.9 Sour...

com.ibeetl:xlsunit (>=1.0.0, <=1.0.4), com.kurento.kmf:kmf-content-api (>=3.0.5, <=4.3.1) +26 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ibeetl:xlsunit =1.0.0, =3.0.5, =1.0.4, =5.0.3, =5.0.4 -...

org.springframework.data:spring-cql (1.4.9.release), org.springframework.data:spring-data-cassandra (1.4.9.release) +13 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.4.9.release -...

org.springframework.data:spring-cql (1.5.2.release), org.springframework.data:spring-data-cassandra (1.5.2.release) +14 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.2.release -...

info.cqframework:cqf-fhir (>=1.5.10, <=1.5.12), info.cqframework:elm-fhir (>=1.5.8, <=1.5.12) +4 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.15)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.15 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:cqf-fhir =1.5.10, =1.5.8, =1.5.6, =1.5.7, =1.5.7, =1.5.9 Sour...

CVE-2026-44337

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

CVE-2026-44337

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

CVE-2026-44337

PraisionAI across versions 2.4.1–4.6.34 exposes optional SQL/CQL-backed knowledge-store backends that derive table and index identifiers from unvalidated collection names. This can enable SQL/CQL injection when applications pass untrusted collection names into these backends. The issue is fixed i...

CVE-2026-44337: Improper Input Validation

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

EUVD-2026-23992

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values...

PYSEC-2026-2177

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588: Improper Neutralization of Special Elements used in an SQL Command

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module "glances/exports/glancescassandra/init.py" interpolates "keyspace", "table", and "replicationfactor" configuration values directly into CQL statements without validation. A user wi...

CVE-2026-35588

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

AZL-82673 CVE-2026-32588 affecting package cassandra 5.0.0-2

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue...