PT-2026-68751

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.19.0 Frappe versions prior to 15.109.0 Description The Data Import feature fails to escape imported column headers before rendering previews and results. This allows an authenticated user to persist malicious script...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

DEBIAN-CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-71287 Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

EUVD-2026-53372

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex pregreplace'/^a-zA-Z0-9./', '', $column. Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a...

PT-2026-68160

Name of the Vulnerable Software and Affected Versions Cacti affected versions not specified Description The sanitize sql column function in lib/functions.php fails to properly sanitize user-supplied ORDER BY column names. The function uses a regular expression that allows letters, digits,...

CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

CVE-2026-70370: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...

CVE-2026-70371: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

CVE-2026-18648

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

CVE-2026-18648

Blix Email Blue Mail Calendar App 2.2.305 is affected by a path traversal in the component react-native-receive-sharing-intent, specifically FileDirectory.getDataColumn/FileDirectory.getFileFromUri. The vulnerability arises from manipulating the _display_name argument, enabling local access explo...

CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15450

The CVE-2026-15450 entry concerns Nex Forms – Ultimate Form Builder – Lite for WordPress (versions ≤ 9.2.3). Affected component is the delete_file() AJAX handler which takes a file path from the database and passes it to unlink() without validation (no realpath/basename/allowlist). Combined with ...

CVE-2026-5626

The CVE affects the WordPress plugin “Survey Form Block” (versions up to and including 1.0.1). A missing capability check in get_all_data() enables authenticated users with Subscriber-level access and above to export all survey submissions and column metadata. Public exploit details are not provi...

Malicious Package

Overview peter-desktop-peter-big-column is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

CVE-2026-65605

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

PT-2026-63971

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A stored cross-site scripting issue exists in the Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping. The EscapeHTML function i...

CVE-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...