WordPress Affiliate Program Suite — SliceWP Affiliates plugin <= 1.2.14 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Kuba in WordPress Plugin SliceWP versions = 1.2.14...

CVE-2026-121881

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

EUVD-2026-118319

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859

The Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) are vulnerable to SQL injection via the write_pandas() data-loading functionality. When identifier escaping is disabled through a non-default configuration, the software fails to escape DataFrame column names b...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by yottt in WordPress Plugin AnyWhere Elementor versions = 1.3.0...

CVE-2026-123489

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123491

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized...

CVE-2026-123488

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and...

CVE-2026-112341

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...

CVE-2026-121881 Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

CVE-2026-121881

An SQL injection vulnerability exists in the get_last_seen code-server session-state RPC of Posit Workbench (versions before 2026.08.0 ) by Posit Software, PBC. The flaw is caused by improper handling of the sessionIds parameter, which allows authenticated users to read arbitrary data from the Wo...

EUVD-2026-118305

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

EUVD-2026-118291

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized...

CVE-2026-123491

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are vulnerable to an SQL injection within the GraphQL eager-loading functionality. The root cause is that arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without proper cleansing....

CVE-2026-123491 Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized...

CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123488

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are vulnerable to an unauthenticated SQL injection in the element search endpoint. The vulnerability exists because the attribute parameter is concatenated into the query unsanitized, and the use of emulated PDO prepares allows for st...

EUVD-2026-118288

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and...