586 matches found
GO-2026-4341 vulnerabilities
Vulnerabilities for packages: gke-gcloud-auth-plugin, goose, reports-server, sops, modelmesh-runtime-adapter, prometheus-nats-exporter, sftpgo-plugin-kms, nrdot-collector-k8s, terraform-provider-azapi-fips, kubernetes-csi-driver-nfs-fips, local-static-provisioner-fips, packer,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: helm-set-status, timescaledb-tune, kubernetes-dashboard-api, dgraph, envconsul, chart-testing, helm-operator, kubernetes-csi-external-health-monitor, controller-gen, guac, terraform-provider-azapi, gobump, wgcf, harbor-cli, k3d, kyverno-notation-aws, nri-nginx,...
CVE-2026-51992
A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the create dictionaries function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system...
CVE-2026-18801
OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....
CVE-2026-18801 Stored Clickhouse SQL Injection Through Customer Usage Attribution
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...
CLEANSTART-2026-QR05590 Security fixes in clickhouse-operator 0.25.5-r0
Package clickhouse-operator version 0.25.5-r0 fixes 2 vulnerabilities: CVE-2025-22868, CVE-2025-22870...
CVE-2026-51992
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code...
EUVD-2026-50412
SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...
CVE-2026-51992
The CVE-2026-51992 entry is rejected/not used and does not represent an active vulnerability.
PT-2026-65845
SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...
CVE-2026-51992
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on...
CVE-2026-51992
SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...
CVE-2026-54658
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...
EUVD-2026-50086
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-54658
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-54658
Hypequery/clickhouse (TypeScript semantic layer for ClickHouse) contains a SQL injection due to escapeValue() not escaping backslashes before single quotes during parameter substitution in packages/clickhouse/src/core/utils.ts, prior to version 2.0.2. This allows attacker-controlled query paramet...