EUVD-2026-101594

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

EUVD-2026-98826

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-103928

The business intelligence platform Metabase is vulnerable to arbitrary file read and write in versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4. The root cause is the failure to restrict host-facing built-in functions when processing native queries or actions against an H2 data source ...