NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

CVE-2026-13060

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

EUVD-2026-47774

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

CVE-2026-13062

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

UBUNTU-CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit f...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...

CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

EUVD-2026-46336

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-58414

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup recursively collects files using collectBackupFiles. collectBackupFiles uses statSyncfull, which follows symlinks. If data/ contains a symlink to a directory outside the environment roo...

CVE-2026-32821

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...

CVE-2026-32821 API Collection Impersonation Via user_email And Missing Object- Level Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...

CVE-2026-32821

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...

Nimux 1.0.2

Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...

SUSE CVE-2026-63816

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...

CVE-2026-63816

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...

CVE-2026-63816 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fsinodeinfo.atomicinode - ioctlF2FSIOCGARBAGECOLLECTRANGE - shrink - f2fsgc - gcdatasegment - radatablockcowinode - mapping = F2FSIinode-atomicinode-imapping : f2fsiscowfilecowinode is true -...