Exploit for Deserialization of Untrusted Data in Metabase

CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Q...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

RHSA-2026:54142 Red Hat Security Advisory: mariadb:10.11 security update

Bulletin has no description...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

creationtimestamp| type| source ---|---|--- 2026-08-12 08:07:14+00:00| seen| https://infosec.exchange/users/certvde/statuses/117081508015288555 2026-08-12 08:51:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bzhod4u7cmjyl 2026-08-14 07:39:23+00:00| seen|...

CVE-2025-41769

creationtimestamp| type| source ---|---|--- 2026-08-12 08:07:14+00:00| seen| https://infosec.exchange/users/certvde/statuses/117081508015288555 2026-08-12 08:44:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/feucti546fepi 2026-08-12 09:20:05+00:00| seen|...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

EUVD-2025-210707

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...

CVE-2026-18789

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

CVE-2026-18789

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

CVE-2026-18789

The Ezoic WordPress plugin (versions before 2.23.1 ) is vulnerable to an unauthenticated database export via Content Export REST routes . The root cause is a failure to properly restrict access to specific content export functionality. An unauthenticated attacker can trigger a server-side export ...

CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

EUVD-2026-57102

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

EUVD-2026-57091

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

PT-2026-71038

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...