PT-2026-59167

Summary Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node labels were concatenated directly into Cypher label expressions without validation. I...

PT-2026-57908

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A SQL injection flaw exists in the /edit exam2.php endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

RHEL 9 : perl-DBI (RHSA-2026:38512)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:38512 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions,...

PT-2026-58947

Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...

PT-2026-59208

Summary In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting...

RHEL 10 : perl-DBI (RHSA-2026:38513)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:38513 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions...

Oracle Linux 9 : perl-DBI (ELSA-2026-38512)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-38512 advisory. - Fix possible stack overflow and buffer overflow in DBI.xs CVE-2026-9698 Tenable has extracted the preceding description block directly from the Oracle Linux...

CVE-2026-15553: Unrestricted Upload of File with Dangerous Type

Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them available for users to download...

CVE-2026-15552: Improper Neutralization of Input During Web Page Generation

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

CVE-2026-12582: Undefined Security Weakness

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes...

CVE-2026-12081: Undefined Security Weakness

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator...

PT-2026-57621

Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them available for users to download...

ROS-20260713-73-0023

The vulnerability of the Aggregate Term Handler component in the SQLite database management system is related to numerical truncation errors. Exploiting this vulnerability could allow an attacker to compromise privacy, integrity, and accessibility of the data...

PT-2026-59045

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of...

PT-2026-59276

Summary The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCP ALLOW ANONYMOUS ACCESS=true is set required for the HTTP server to function without OAuth/API...

Linux Distros Unpatched Vulnerability : CVE-2026-53448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQ...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: An authenticated administrator can supply an untrusted update-package path to the configuration API, causing phpMyFAQ to write an arbitrary PHP file to the server and thereby execute attacker-controlled code. An attacker can exploit a path traversal in the category image...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Buffer overfl...

Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: DBI: DBI: Buffer overflow in...

CVE-2026-15514

A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipulation of the argument phprpcargs can lead to sql injection. T...