GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: yaml-language-server, jupyter-base-notebook, opensearch-dashboards, vitess, argo-workflows, prism, tileserver-gl...

CVE-2026-81521

A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...

ManageEngine PAM360 < Build 8561 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine PAM360 application running on the remote host is prior to build 8561. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious query to execu...

Linux Distros Unpatched Vulnerability : CVE-2026-65140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The vulnerability exists due to a privilege escalation flaw within the accounting database layer that allows a lower-privileged operator account to alter...

FreeBSD : jenkins -- multiple vulnerabilities (102bc631-a6da-11f1-ba21-00e0edd85c6a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 102bc631-a6da-11f1-ba21-00e0edd85c6a advisory. Jenkins Security Advisory 2026-09-02: Tenable has extracted the preceding description block...

Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution Date: 2026-08-12 Exploit Author: Gutierre0x80 Vendor Homepage: https://www.metabase.com/ Software Link: https://github.com/metabase/metabase Version: = 0.58.0 = 0.59.0 = 0.60.0 = 0.61.0 Example: python3 exploit.py...

PT-2026-90777

Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database...

CVE-2026-65140

Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database...

UBUNTU-CVE-2026-65139

Fix various issues in unsafe operation/queries to the slurmdbd...

CVE-2026-84962: Improper Neutralization of CRLF Sequences

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-85239: Improper Input Validation

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

After Veeam ONE 13.1.0.7034 Upgrade: No connection could be made because the target machine actively refused it. (localhost:2743)

Article Applicability The issue described in this article only occurs for deployments in which Veeam ONE was installed to a folder other than the default C:\Program Files\Veeam\Veeam ONE\ path. Challenge After Veeam ONE is upgraded to version 13.1 build 13.1.0.7034, reports cannot be generated an...

CVE-2026-85155: Improper Neutralization of Special Elements used in an SQL Command

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

UBUNTU-CVE-2026-65140

Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database...

Security Bulletin: IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [CVE-2026-18175, CVE-2026-18221]

Summary IBM i is vulnerable to manipulation of database transactions due to improper authorization CVE-2026-18175 and allowing unathorized access due to improper validation CVE-2026-18221 in Distributed Data Management DDM / Distributed Relational Database Architecture DRDA as described in the...

@etherio/database (>=0.0.1, <=0.0.13), @gridnt/ngplus (1.0.3) +23 more potentially affected by unknown CVE via axois (0.0.1-security)

axois NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on axois and may be impacted: - @etherio/database =0.0.1, =0.5.6, =3.10.2-alpha.0, =0.0.27, =0.0.27, =1.0.0, =1.0.2, =0.1.0, =1.0.1, =1.0.10 and more Source cves: unknown CVE...

EUVD-2026-42744

Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db...

CVE-2026-16241

A flaw was found in PostgreSQL ECPG. A highly privileged database server administrator can trigger an integer underflow by sending a specially crafted bytea value to the ECPG client. This vulnerability causes the client to overwrite a large memory region, leading to a temporary denial of service...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

dbeaver v26.2.0

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...