PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

CVE-2026-79794: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database...

CVE-2026-39747: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Woffice = 5.4.35 versions...

CVE-2026-76754: Improper Neutralization of Special Elements used in a Command

A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands...

CVE-2026-95112: Inefficient Algorithmic Complexity

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

PT-2026-106779

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as...

PT-2026-106418

Name of the Vulnerable Software and Affected Versions Database for CF7 versions prior to 1.2.7 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into the application. Recommendatio...

CVE-2026-39731: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

PT-2026-106485

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

io.trino:trino-iceberg (>=464, <=468), io.trino:trino-snowflake (>=464, <=468) +4 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.19.1)

net.snowflake:snowflake-jdbc MAVEN version 3.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.trino:trino-iceberg =464, =464, =1.7.0, =10.6.32, =10.6.32, =10.6.32, =10.6.34 Source cves:...

database-factory (>=1.0.5, <=1.0.6), rcd-dev-kit (>=1.4.0, <=2.0.4) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.9)

snowflake-connector-python PYPI version 2.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - database-factory =1.0.5, =1.4.0, =2.0.4 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

com.codbex.atlas:codbex-atlas-application (>=2.54.0, <=2.57.0), com.codbex.gaia:codbex-gaia-application (2.58.0) +8 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.24.1)

net.snowflake:snowflake-jdbc MAVEN version 3.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.54.0, =2.47.0, =2.47.0, =11.47.7, =11.47.7, =11.47.7,...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 Discovery On February 21, 2025, an SQL injection vulnerability was identified in the “Multiplan” platform developed by ITC Systems during a client engagement. Affected Versions This vulnerability has been only been tested on v3.7.4.1002 Attack Vector The...

EUVD-2026-91788

Multiple @opentelemetry/instrumentation- packages expose database username via unconditional db.user span attribute...

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

GHSA-QQMP-WF37-98F9 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

CVE-2026-88424

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-63268

A flaw was found in LibreOffice Calc. An attacker could craft a spreadsheet document with an external database link that points to local text files. If a user opens the malicious document, the application automatically reads the local file contents into the sheet, leading to unauthorized...