CVE-2026-11391

Tanium addressed a SQL injection vulnerability in Patch...

EUVD-2026-50019

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-50736

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...

CVE-2026-7769

CVE-2026-7769 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). Root cause: SQL injection in the backend database interface. Impact: remote attacker could view, add, modify, or delete data in the back-end DB. CVSS...

CVE-2026-51303

A flaw was found in SQLite. A remote attacker can exploit a use-after-free vulnerability in the core parsing component by sending specially crafted SQL queries. This can lead to an application crash, sensitive information disclosure, and potentially allow the attacker to execute arbitrary code on...

CVE-2026-16462

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

EUVD-2026-49733

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

EUVD-2026-49240

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

CVE-2026-59537

The CVE concerns the WordPress plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce (

EUVD-2026-49203

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

EUVD-2026-49200

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

BIT-WORDPRESS-MULTISITE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

PT-2026-64985

A use-after-free UAF vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply speciall...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

SUSE CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

[SECURITY] [DSA 6399-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6399-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2026 https://www.debian.org/security/faq -...