EUVD-2026-68404

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint. The endpoint grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation , allowing an attacker to read arbitrary tables from any workspace...

CVE-2026-65642

A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...

CVE-2026-82624

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624 code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624

code-projects Simple Inventory System 1.0 is affected by an information disclosure vulnerability in the file inventorymanagement.sql , within the Database Backup File Handler component. The specific root cause is described as "some unknown functionality" of that file. The flaw is exploitable remo...

EUVD-2026-68369

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-14671

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server. Mitigation To mitigate this vulnerability,...

PT-2026-83988

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite...

CVE-2026-54598: Missing Authentication for Critical Function

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite...

PT-2026-83746

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join tables endpoint that grants JOIN TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-54600: Improper Authentication

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

CVE-2026-82870: Authorization Bypass Through User-Controlled Key

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-75133: Missing Authentication for Critical Function

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

PT-2026-83990

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.4 Description An authentication bypass exists in the 'endpoints/db/import.php' endpoint. On fresh or unconfigured installations where the user table row count is zero, an unauthenticated attacker can replace the...

CVE-2026-82869: Authorization Bypass Through User-Controlled Key

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

PT-2026-83711

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

Security update for postgresql14 (important)

openSUSE security update: security update for postgresql14 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21699-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...