1551 matches found
rConfig 3.9.4 - SQL Injection
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...
CVE-2026-126198
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...
CVE-2026-126199 pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation...
EUVD-2026-124570
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation...
CVE-2026-126199
The pgEdge Postgres MCP Server (prior to version 1.1.0 ) contains a vulnerability where the bundled CLI and web clients fail to request user confirmation for specific write operations. The root cause is that the application classifies query_database statements based only on the first keyword. Con...
EUVD-2026-124569
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...
CVE-2026-126198 pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...
CVE-2026-126198 pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...
CVE-2026-126198: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...
PT-2026-145904
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query database on a read only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query...
PT-2026-145906
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query database tool name...
PT-2026-145907
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query database statements only by their first keyword before deciding whether to display a write confirmation...
CVE-2026-126199: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation...
CVE-2024-43468_mTLS_go
CVE-2024-43468 SCCM SQL Injection Exploit mTLS client certs from MacOS keychain version Go implementation of CVE-2024-43468 exploit that uses macOS Keychain for mTLS authentication without need to export keys from keychain. Additionally: Added proxy support to not use problematic proxychains. Add...
CVE-2025-54554
CVE-2025-54554 CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information Disclosure Discoverer: Amanpreet Parmar | Sr. Security Engineer @Harvard Medical School Summary: CVE-2025-54554 identifies a vulnerability in the tiaudit component of the ticrypt platform,...
CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memo...
CVE-2026-123531
The software Vikunja (versions 1.0.0 before 2.7.1) is vulnerable to an uncontrolled resource consumption vulnerability (CWE-400). Authenticated users can bypass the service.maxitemsperpage limit by sending a page=0 parameter to /api/v1 list endpoints. This flaw allows an attacker who can self-reg...
CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memo...
CVE-2026-119376
A flaw was found in SQLite. An attacker can cause a Denial of Service DoS by supplying specially crafted SQL queries or an untrusted database view containing deeply chained COLLATE operators. This flaw bypasses expression depth limitations, triggering unbounded recursion and stack exhaustion that...