84044 matches found
CVE-2026-66803
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...
CVE-2025-69933
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1...
CVE-2025-69934
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...
CVE-2025-69931
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...
CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...
CVE-2026-62845
Kamaji (Hosted Control Plane Manager for Kubernetes) is affected by a SQL injection in the PostgreSQL and MySQL datastore drivers. The root cause is that DataStoreUsername and DataStoreSchema are interpolated into SQL statements via fmt.Sprintf without escaping identifiers, and these fields have ...
CVE-2026-62246 Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...
EUVD-2026-51302
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...
CVE-2026-67594
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...
CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
CVE-2026-67208
CVE-2026-67208 – Juggle 1.6.0 exposes an unauthenticated remote code execution via the exposed H2 database web console. An attacker can reach the unprotected /h2-console endpoint, authenticate with default shipped credentials, and use the H2 CREATE ALIAS Runtime.exec() technique to execute arbitr...
EUVD-2026-51278
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
CVE-2026-10535
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...
CVE-2026-67594
Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...
CVE-2026-67594 Spikster Missing Authentication via API Route Group
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)
Last week, there were 223 vulnerabilities disclosed in 175 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 88 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities...
MGASA-2026-0308 Updated perl-DBI packages fix security vulnerabilities
The updated packages fix several security issues...
CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...
CVE-2026-10535
IBM Db2 is vulnerable to a stack-based buffer overflow in the setgid helper db2flacc, enabling privilege escalation from an unprivileged shell. Affected products/versions include IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.4 (Linux/Unix; Windows not affected). CVE-2026-10535, CWE-121, has a base CVSS v...
