94249 matches found
The vulnerability of the pgAdmin 4 database management tool, related to deficiencies in access control, allows attackers to escalate their privileges.
The vulnerability of the pgAdmin 4 database management tool is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...
CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability
...
SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72806. Summary FilterViewByPublishAccess, the filter renderAttributeView applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result,...
CVE-2026-85453 MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface...
CVE-2026-85424 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...
GHSA-FPH3-GHQ9-VW66 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
CVE: This vulnerability corresponds to CVE-2026-69083. Summary The /api/search/fullTextSearchAssetContent endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false: 1. method 2 passes...
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
CVE: This vulnerability corresponds to CVE-2026-69083. Summary The /api/search/fullTextSearchAssetContent endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false: 1. method 2 passes...
GHSA-FPH4-WMHF-6FWF vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, prism, tileserver-gl, opensearch-dashboards, argo-workflows, vitess...
GHSA-73WF-GQ98-2V4G vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, ts-patch, langfuse, argo-workflows, kubeflow-katib, vitess...
CVE-2026-81521
A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...
UBUNTU-CVE-2026-65139
Fix various issues in unsafe operation/queries to the slurmdbd...
CVE-2026-85239: Improper Input Validation
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
CVE-2026-84962: Improper Neutralization of CRLF Sequences
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...
CVE-2026-85155: Improper Neutralization of Special Elements used in an SQL Command
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...
PT-2026-90777
Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database...
FreeBSD : jenkins -- multiple vulnerabilities (102bc631-a6da-11f1-ba21-00e0edd85c6a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 102bc631-a6da-11f1-ba21-00e0edd85c6a advisory. Jenkins Security Advisory 2026-09-02: Tenable has extracted the preceding description block...
Linux Distros Unpatched Vulnerability : CVE-2026-65140
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database...
ManageEngine PAM360 < Build 8561 SQLi (CVE-2026-14828)
According to its self-reported build number, the ManageEngine PAM360 application running on the remote host is prior to build 8561. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious query to execu...
