CVE-2026-79852

CVE-2026-79852 involves an unauthenticated SQL Injection vulnerability within the AOS Web-Based Management Interface . This security flaw can lead to Remote Code Execution (RCE) by an attacker. While the provided documents confirm the vulnerability type and potential impact, specific software ver...

CVE-2026-79852 Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79849

Unauthenticated SQL Injection Vulnerabilities in AOS-8 can lead to Remote Code Execution . While the provided documents do not specify the exact component or root cause, the impact is significant as it allows for unauthenticated remote access. Specific remediation details or exploit links are not...

CVE-2026-79849 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79849 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79848 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79848

The AOS-8 operating system is vulnerable to unauthenticated SQL injection vulnerabilities that can lead to Remote Code Execution . While the provided documents do not specify the exact affected component or root cause, the vulnerability allows for remote exploitation without authentication. No sp...

CVE-2026-79848 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

OESA-2026-4423 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4422 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4421 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4420 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

GHSA-7587-9684-52R6 mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

SQL Injection

Overview mem0ai is a Long-term memory for AI Agents Affected versions of this package are vulnerable to SQL Injection via the Databricks vector store in mem0/vectorstores/databricks.py, where user-controlled payload values and vector IDs are interpolated directly into SQL statements without...

Vulnerabilities found in Cisco Expressway Series devices

Cisco has identified several vulnerabilities in the Cisco Expressway Series. These vulnerabilities involve insufficient authorization checks during Mobile and Remote Access provisioning, allowing unauthorized external attackers to gain access to sensitive information. Additionally, there is a...

CVE-2026-115331

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115332

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...