CVE-2026-94451 Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

cn.net.vidyo:jsmth-data (3.3.120.release), cn.net.vidyo:jsmth-msg (3.3.120.release) +6 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (2.8.2)

com.rabbitmq:amqp-client MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release - cn.net.vidyo:jsmth-msg 3.3.120.release - cn.net.vidyo:jsmth-orm...

cn.net.vidyo:jsmth-data (3.3.120.release), cn.net.vidyo:jsmth-msg (3.3.120.release) +6 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (2.8.2)

com.rabbitmq:amqp-client MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release - cn.net.vidyo:jsmth-msg 3.3.120.release - cn.net.vidyo:jsmth-orm...

cn.net.vidyo:jsmth-data (3.3.120.release), cn.net.vidyo:jsmth-msg (3.3.120.release) +6 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (2.8.2)

com.rabbitmq:amqp-client MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release - cn.net.vidyo:jsmth-msg 3.3.120.release - cn.net.vidyo:jsmth-orm...

CVE-2026-104956

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15307 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CVE-2026-103237

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

EUVD-2026-89760

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237

The MISP application (versions

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237: Authorization Bypass Through User-Controlled Key

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

PT-2026-103115

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The hostfilter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relatio...

automation-controller: automation-controller: WorkflowJobNode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via ORM-traversal count-oracle

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...