CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

EUVD-2026-68404

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-65642

A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...

CVE-2026-82624

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624

code-projects Simple Inventory System 1.0 is affected by an information disclosure vulnerability in the file inventorymanagement.sql , within the Database Backup File Handler component. The specific root cause is described as "some unknown functionality" of that file. The flaw is exploitable remo...

CVE-2026-82624 code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

EUVD-2026-68369

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-14671

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server. Mitigation To mitigate this vulnerability,...

PT-2026-83747

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description Insufficient validation of organizationId ownership in database write and destroy routes allows users with the builder role to perform unauthorized actions on databases belonging to other...

PT-2026-83988

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite...

CVE-2026-82870: Authorization Bypass Through User-Controlled Key

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-82869: Authorization Bypass Through User-Controlled Key

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

PT-2026-83711

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

Security update for postgresql15 (important)

openSUSE security update: security update for postgresql15 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21700-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...

Security update for postgresql14 (important)

openSUSE security update: security update for postgresql14 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21699-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...

PT-2026-83746

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join tables endpoint that grants JOIN TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82624: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-54600: Improper Authentication

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

PT-2026-83990

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.4 Description An authentication bypass exists in the 'endpoints/db/import.php' endpoint. On fresh or unconfigured installations where the user table row count is zero, an unauthenticated attacker can replace the...

PT-2026-83878

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbd cron process parameter without authentication. Attackers can predict the...