airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-45192 via apache-airflow (2.0.2)

apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-45192 Source advisory:...

SQL Injection

Overview agno is an Agno: a lightweight library for building Multi-Agent Systems Affected versions of this package are vulnerable to SQL Injection via the deletebymetadata function in the clickhouse backend. An attacker can execute unintended SQL commands by supplying malicious metadata keys and...

agno contains a SQL injection vulnerability

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

GHSA-82M5-3PCP-HCCQ agno contains a SQL injection vulnerability

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

EUVD-2026-33358

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105

CVE-2026-10105 affects agno 2.6.5, where the ClickHouse vector database backend exposes a SQL injection via the delete_by_metadata() method. The root cause is unsafe f-string interpolation in clickhousedb.py, enabling attackers to inject arbitrary SQL expressions through malicious metadata keys/v...

CVE-2026-10105

agno contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.p...

CVE-2026-10105 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

Agno SQL injection vulnerability

Agno is an open-source full-stack framework developed by Agno for building multi-agent systems with memory, knowledge, and reasoning capabilities. Version 2.6.5 of Agno contains a SQL injection vulnerability. This vulnerability stems from SQL injections in the ClickHouse vector database backend,...

PT-2026-55377

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete by metadata method. Attackers can exploit the unsafe f-string interpolation in...

CVE-2026-10105: Improper Neutralization of Special Elements used in an SQL Command

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

PT-2026-44922

Name of the Vulnerable Software and Affected Versions agno version 2.6.5 Description A SQL injection issue exists in the ClickHouse vector database backend. Attackers can inject arbitrary SQL expressions by providing malicious metadata keys and values to the delete by metadata function. This is...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +16 more potentially affected by unknown CVE via flask-admin (>=1.4.0, <=1.5.3)

flask-admin PYPI version =1.4.0, =0.5.1, =1.0.0, =1.10.0, =1.10.3b1, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.3a0, =0.5.4rc0, =1.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2016-0075...

com.github.goodforgod:micronaut-clickhouse (2.2.0), com.slack.api:bolt-micronaut (1.7.1) +86 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.4.1)

io.micronaut:micronaut-inject MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.github.goodforgod:micronaut-clickhouse 2.2.0 - com.slack.api:bolt-micronaut 1.7.1 -...

airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-40690 via apache-airflow (2.0.2)

apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-40690 Source advisory:...

airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-40690 via apache-airflow (2.3.4)

apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-40690 Source advisor...