CVE-2026-54348

Froxlor (open-source server administration panel) prior to 2.3.8 is affected by a second-order SQL injection in its admin API. The Admins.add/Admins.update endpoints store an attacker-controlled ipaddress array as JSON in panel_admins.ip without numeric type enforcement. When the poisoned account...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

EUVD-2026-61150

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-52723

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestjgtg72p 2026-08-18 19:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6fc7cl2j...

SUSE-SU-2026:23192-1 Security update for rpm

This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...

WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability

Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-56684

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

nmap-vulners v1.5

nmap-vulners Turn an nmap service scan into a list of CVEs, CVSS scores and known exploits. Three NSE scripts that take the software nmap already identified, ask the Vulners database what is known about it, and print the answer inside the scan report. The three scripts Script| Needs a key| What i...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-23933

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...

UBUNTU-CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

Akamai Valkey Managed Database: Real-Time Memory for Enterprise AI

Introducing Akamai Valkey Managed Database: a low-latency, in-memory data layer to optimize AI inference costs, accelerate RAG, and power real-time AI agents...

The Vulners team has released an updated version Getsploit

The Vulners team has released an updated version ofGetsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode search queries are executed on the Vulners server and a fully offline mode exploit data from Vulners is downloaded to a...

CVE-2026-23933

In Zabbix 7.4 , a cryptographic key used for signing Frontend sessions was erroneously written to the database seed. This vulnerability specifically impacts deployments utilizing both SAML authentication and guest users , where the key can be used to forge valid session cookies, potentially leadi...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...