CVE-2026-8297

CVE-2026-8297 describes an SQL injection in GisLab Laboratory Management System by Gis Informatics Engineering Consulting (Gis Informatics). Affected versions: 1.4.03 through 08072026. The issue is a generic SQL injection vulnerability with network attack vector, no user interaction, and no privi...

SQL-Injection-Security-System

...

CVE-2026-63094

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

CVE-2026-41850

A flaw was found in Spring Framework. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. A remote attacker can exploit this by providing a specially crafted expression, which triggers excessive resource...

SUSE-SU-2026:3102-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues - Update to version go1.26.5 bsc1255111. - CVE-2026-27145: crypto/x509: split candidate hostname only once bsc1267450. - CVE-2026-39822: os: Root escape via symlink plus trailing slash bsc1271014. - CVE-2026-42504: mime: quadratic complexi...

SUSE CVE-2026-57074

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read...

CVE-2026-16014 code-projects Hospital Bed Management System Login Form sql injection

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and...

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394. Patch Instructions: To install this SUSE...

SUSE-SU-2026:3098-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

CVE-2026-16009

The provided Connected documents identify CVE-2026-16009 in itsourcecode Hospital Management System 1.0. Affected is an unknown function in /prescriptionorderdetail.php where manipulating the delid argument invokes SQL injection. The vulnerability can be exploited remotely, and public exploits ar...

EUVD-2026-45051

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities

Connected and Autonomous Vehicles CAVs rely on interconnected software and hardware components, including sensors, Electronic Control Units, in-vehicle infotainment systems, and telematics units, where vulnerabilities can compromise assets, users, and vehicle operations. These vulnerabilities are...

PT-2026-60899

Name of the Vulnerable Software and Affected Versions PocketSphinx versions 5prealpha through 5.1.0 Description The trie language model code fails to check boundary conditions when reading headers of ARPA, DMP, and binary format language model files, which can lead to stack and heap buffer...

PT-2026-60776

Name of the Vulnerable Software and Affected Versions SigNoz versions prior to 0.133.1 Description An open redirect flaw exists in the SSO authentication flow for instances configured with Google OAuth, SAML, or OIDC. Unauthenticated attackers can exploit this by calling the sessions context...

The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the issue of buffer overflows. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access t...

golang-github-openprinting-ipp-usb security update

0.9.27-7.2 - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 0.9.27-7.1 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 0.9.27-7 - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810...

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATESECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...

CVE-2026-63397

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

GHSA-X9F9-R4M8-9XC2 ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...