CVE-2026-73034: Improper Limitation of a Pathname to a Restricted Directory

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

PT-2026-70890

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.1 Description An unauthenticated path traversal issue exists in the Python file-upload endpoint. Remote attackers can write arbitrary files to any location on the server by injecting directory traversal sequences into the us...

CVE-2026-73068: Authorization Bypass Through User-Controlled Key

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

CVE-2026-48079: Insufficient Session Expiration

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

CVE-2026-66803

CVE-2026-66803 affects Azure Cosmos DB and is described as improper access control that allows an unauthorized attacker to execute code over a network. The connected records corroborate this as a remote code execution vulnerability, with a CVSSv3.1 base score of 10.0 (CRITICAL) and network attack...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

Azure Cosmos DB Remote Code Execution Vulnerability

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz , which codenamed the chain CosmosEscape , said the exploit chain began with a...

KLA91184 ACE vulnerability in Microsoft Azure

A remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code, bypass security restrictions. Original advisories CVE-2026-66803 Exploitation CVE list CVE-2026-66803 critical Solution Install necessary updates from the ...

PT-2026-66599

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description Improper access control allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a fi...

CVE-2026-66803: Improper Access Control

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-13119

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...

CVE-2026-65761: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

@n8n/backend-test-utils (1.32.0), @n8n/db (1.32.0) +3 more potentially affected by unknown CVE via n8n-core (2.32.0)

n8n-core NPM version 2.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 1.32.0 - @n8n/db 1.32.0 - @n8n/n8n-nodes-langchain 2.32.0 - @n8n/task-runner 2.32.0 - n8n 2.32.0 Source cves: unknown CV...

CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...

CVE-2026-63685

The Joomla Extension by regularlabs.com contains an authorization bypass vulnerability in the DB Replacer extension . The flaw exists because administrator routes and replacement requests do not consistently require Super User permission or a valid token . This allows an unauthorized backend user...

CVE-2026-13066

CVE-2026-13066 affects MongoDB deployments that use server-side JavaScript. The root cause is improper handling of DBPointer objects during BSON serialization in the server’s JavaScript engine, which can cause internal process memory contents to be included in data returned to the client. The ava...