CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675

CVE-2026-81675 is an SQL injection vulnerability in TOOOLS' iSquad , specifically in the endpoint /ws/apiprensa/getVideoUltimasSeccion via the id_seccion parameter. The parameter is directly embedded in a complex SQL query involving grouping and sorting operations, allowing an attacker to disrupt...

BIT-NEO4J-ENTERPRISE-2026-1337 Insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...

CVE-2026-77989

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

EUVD-2026-66862

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989

This is a reflected XSS in the Joomla Events Manager extension prior to version 5.0.1 . The root cause lies in the buildCurrentPdfLink function, which copies the current request query string into the PDF button URL, and pdfbutton() echoes it without escaping, creating a reflected XSS vector via t...

EUVD-2026-66816

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

CVE-2026-30063

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

PT-2026-82529

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

CVE-2026-30063

The free5gc v4.0.1 software contains a vulnerability in its NF Discovery endpoint . An attacker can trigger a Denial of Service (DoS) by sending a crafted snssais query . According to the Rapid7 documentation, the root cause is the allocation of resources without limits or throttling . Exploitati...

PT-2026-82626

Name of the Vulnerable Software and Affected Versions Flowintel version 3.3.0 Description An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a user id parameter to identify the user whose assignments are...

CVE-2026-30063

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

CVE-2026-30063

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

The vulnerability of the jsonArrayContains() function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, allows a perpetrator to execute arbitrary code.

The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability could allow an...

PT-2026-82424

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-30063: Allocation of Resources Without Limits or Throttling

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

PT-2026-82497

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure an...

EUVD-2026-67113

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted snssais query...

CVE-2026-81527: Improper Neutralization of Special Elements in Data Query Logic

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...