CVE-2026-110609

The Dromara Skyeye application (through commit 65d3ddcede70) is vulnerable to SQL Injection via the keyword parameter in the queryErpOrderItem MyBatis statement. The root cause is the use of raw ${} substitution instead of prepared statements. Authenticated low-privileged users can send crafted k...

EUVD-2026-101237

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CLEANSTART-2026-YX80273 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CVE-2026-110609: Improper Neutralization of Special Elements used in an SQL Command

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

PT-2026-114051

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-130052)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130052 advisory. In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not. Tenable has extracted the...

CLEANSTART-2026-ZX34882 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

WordPress KeyWord Collector plugin <= 1.4 - Unauthenticated Stored XSS and Settings Update vulnerability

Unauthenticated Stored XSS and Settings Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin KeyWord Collector versions = 1.4...

eviltree

EvilTree Una reedición independiente en python3 del clásico comando "tree" con la funcionalidad adicional de buscar palabras clave/expresiones regulares proporcionadas por el usuario en archivos, resaltando aquellos que contengan coincidencias. Creado por dos razones principales: Al buscar secret...

psudohash

psudohash Nuevas características interesantes de v1.1.0 Agradecimientos especiales a DavidAngelos: ▶️ Se añadió una barra de progreso en cada paso para rastrear la ejecución. ▶️ Se añadieron opciones: Uniones en orden -i / --inorder: combinar palabras clave solo en el orden original ej. foo,bar,baz...

CVE-2026-88905

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

EUVD-2026-96777

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88905

The KeyWord Collector WordPress plugin, affecting versions through 1.4 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and unauthorized settings updates. The root cause is a lack of authorisation or nonce checks when saving settings via WPKeyWordSettings, combined with a fail...

PT-2026-110051

Name of the Vulnerable Software and Affected Versions KeyWord Collector versions prior to 1.5 Description Lack of authorization and nonce checks when saving settings allows unauthenticated attackers to perform a stored Cross-Site Scripting XSS attack. This occurs because the plugin fails to escap...