SUSE-SU-2026:3283-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

CVE-2026-65876

CVE-2026-65876 affects the Joomla extension from joomshaper.com, specifically the SP Page Builder pre-6.7.1. The vulnerability arises from improper validation of catid parameters in the loadMoreArticles endpoint, yielding an unauthenticated SQL injection. The CVSS 4.0 vector indicates network acc...

CVE-2026-65877 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

CVE-2026-65766

CVE-2026-65766 affects the Joomla extension SP Page Builder by joomshaper.com, where unauthenticated SQL injection is possible due to improper validation of order parameters in the Dynamic Content endpoint in versions earlier than 6.7.1. The vulnerability enables an attacker to leverage an SQL in...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

CVE-2026-13152

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

CVE-2026-13152

The CVE concerns the Custom Fields Account Registration For WooCommerce WordPress plugin, pre-1.4. The issue allows an unauthenticated user who registers an account to gain administrator privileges by writing to the user capabilities meta key on sites using a non-default database table prefix, if...

EUVD-2026-49069

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

Exploit for Interpretation Conflict in Wordpress

wp2shell CVE-2026-63030 + CVE-2026-60...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

Exploit for SQL Injection in Wordpress

No d...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

IBM DB2 Remote Code Execution (7279479) (Windows)

According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2021-32086

CVE-2021-32086 affects Quest KACE Systems Deployment Appliance (SMA) 11.0.273. The issue is a hardcoded symmetric encryption key used to encrypt secrets in MySQL databases, with the key not unique per installation. If an attacker gains access to the MySQL server or backup files, they can decrypt ...

PT-2026-64982

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON extraction function. The problem occurs when the program continues to access internal members of a freed pointer after the JsonParse object memory has been released via...

Oracle Database Server (July 2026 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easil...

EUVD-2026-49351

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...