PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

PT-2026-70857

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A flaw in the query subsystem allows an authenticated user with read privileges to trigger an unexpected termination of the server process. This is achieved by submitting a specially...

CVE-2026-66832: Use of GET Request Method With Sensitive Query Strings

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

PT-2026-70861

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the JavaScript scripting engine allows an authenticated user with write privileges to execute controlled code within the query scope of other users. This occurs when a...

CVE-2026-72750: Improper Neutralization of Special Elements used in an SQL Command

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...

PT-2026-70837

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue exists in the handling of certain query predicates against time-series collections that utilize a metaField. This flaw allows an authenticated user with write access to trigge...

PT-2026-70855

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A flaw in the query planner allows an authenticated user with read-level privileges to trigger an unexpected termination of the server process. This occurs when a specially formed quer...

CVE-2026-18694: Out-of-bounds Read

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...

CVE-2026-18708: Improper Control of Generation of Code

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

PT-2026-70216

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.77.2 Description The VQL query plugin allows executing a VQL query within a different organization or user context. To perform this action, the calling user must possess the IMPERSONATE permission. The issue...

CVE-2026-18635: Incorrect Authorization

Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...

CVE-2026-18701: Access of Resource Using Incompatible Type

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service...

CVE-2026-18699: NULL Pointer Dereference

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

PT-2026-70851

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in geospatial query processing allows an authenticated user with write privileges to store malformed geometry data that is processed without proper validation. Subsequent...

CVE-2026-18711: Use After Free

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

EUVD-2026-55837

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914

Mastodon prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 exposes a resource exhaustion risk via administrative statistics endpoints (Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController). Anonymous callers can pass keys, start_at, and end_at to trigger long-running...