EUVD-2026-75393

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

CVE-2026-78082

SP Property is a Joomla extension by joomshaper.com vulnerable to unauthenticated SQL injection in versions prior to 4.1.4 . The root cause lies in the property search and listing query builders, which assembled WHERE and ORDER BY clauses (for zipcode, sorting, price_range_dropdown, and psize_ran...

CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

EUVD-2026-75367

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803

CVE-2026-87803 is an authorization bypass in Countly Server DBViewer caused by flawed sub-pipeline detection in the aggregation stage sanitizer at the /o/db endpoint. When the sanitizer encounters an unrecognized key such as the undocumented MongoDB-internal $_internalInhibitOptimization, it misc...

Security Bulletin: SQL injection vulnerability in IBM Cloud Pak for Business Automation Operational Decision Manager component - CVE-2026-18658

Summary IBM Operational Decision Manager in IBM Cloud Pak for Business Automation is vulnerable to a SQL injection attack. Vulnerability Details CVEID:CVE-2026-18658 DESCRIPTION: IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

WsgiDAV MySQL provider has a blind SQL injection

SummaryThe sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

aiosmtplib: STARTTLS response injection

ImpactWhen a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

ImpactA Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

PYSEC-2026-3805 aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

senaite.core Vulnerable to Eval Injection and Missing Authorization

SummaryAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

PYSEC-2026-3919 senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

PYSEC-2026-3817 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

PYSEC-2026-3812 Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected?Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. SummaryWhen MCP is...