PT-2026-133439

CVE-2026-116366 first CVE on my name just dropped. unauthenticated RCE on any @ClickHouseDB instance using just the public service hostname. special thanks to San and the ClickHouse security team. the report was accepted within 20 minutes on Bugcrowd. P.S. Clickhouse Security Team emailed me 1 ho...

CVE-2026-10105

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...

agno contains a SQL injection vulnerability

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the deletebymetadata method. Attackers can exploit the unsafe f-string interpolation in...