CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-73211 PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...

CVE-2026-73211

PeerTube (ActivityPub-federated video platform) pre-8.1.6 is affected by an unauthenticated remote SQL injection in ActorFollowModel.updateScore(), where the attacker-controlled inboxUrl is interpolated into an SQL query. This allows reading and writing of database tables, including oAuthToken.ac...

CVE-2026-48771

CVE-2026-48771 affects the ishankportfolio site prior to version 1.0.1, where a misconfigured client-side database and permissive access policies could allow unauthenticated readers to read, modify, or abuse stored contact form submissions. The impact includes exposure of PII such as names, email...

CVE-2026-48771 ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

EUVD-2026-56785

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-63522

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

DEBIAN-CVE-2025-31938

Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentiall...

CVE-2026-63522

Azure SQL Database is the affected product for CVE-2026-63522, described as an incorrect permission assignment for a critical resource that allows an authorized attacker to elevate privileges locally. The issue has a base CVSSv3.1 score of 7.8 (HIGH) with LOCAL access, low attack complexity, and ...

CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability

...

EUVD-2026-56769

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability

...

EUVD-2026-56724

CVET-EOP...

CVE-2026-73068

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

CVE-2026-73068 ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

EUVD-2026-56186

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

CVE-2026-47702 TypeBot API tokens stored in plaintext

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...

CVE-2026-47702 TypeBot API tokens stored in plaintext

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...

CVE-2026-46670 YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

SQL Injection

Overview civicrm/civicrm-core is an open source constituent relationship management for non-profits, NGOs and advocacy organizations. Affected versions of this package are vulnerable to SQL Injection via the contact search RLIKE clause. An attacker can access and extract the entire database by...