MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

Arbitrary Code Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Arbitrary Code Injection via the import process. An attacker can execute arbitrary code on the server and manipulate the database schema by supplying...

EUVD-2026-42695

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation...

SQL Injection

Overview WsgiDAV is a Generic and extendable WebDAV server based on WSGI Affected versions of this package are vulnerable to SQL Injection via the MySQLBrowserProvider process. An attacker can extract arbitrary data from the backing database by injecting crafted SQL through the URL, exploiting th...

GHSA-Q79R-R9XG-R863 Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

Impact A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user but not the password itself,...

EUVD-2026-67856

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-80714

creationtimestamp| type| source ---|---|--- 2026-08-28 17:03:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117174214140955444 2026-08-29 17:40:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muagbl2hlr2u 2026-08-31 09:56:56+00:00| seen|...

SUSE CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

CVE-2026-82078

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

[SECURITY] Fedora 44 Update: postgresql16-anonymizer-3.1.3-1.fc44

PostgreSQL Anonymizer is an extension to mask or replace personally identifiable information PII or commercially sensitive data from a PostgreSQL database. The project has a declarative approach of anonymization. This means you can declare the masking rules using the PostgreSQL Data Definition...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

EUVD-2026-67714

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078

CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470, CVSS 9.4 Critical) in the database connection utilities of PaperCut NG and PaperCut MF . The application instantiates database driver classes from configurable names without an allowlist, allowing arbitrary Java bytecode to...

EUVD-2026-67343

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to spoofing vulnerabilty in MSSQL JDBC driver (CVE-2025-59250)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed MSSQL JDBC driver vulnerability Vulnerability Details CVEID:CVE-2025-59250 DESCRIPTION: Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-78500

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

EUVD-2026-67328

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-76794: Improper Neutralization of Input During Web Page Generation

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...