CVE-2026-59827

CVE-2026-59827 — Désérialisation non sécurisée des résultats de requêtes H2 dans Metabase GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critique | CWE-502 : Désérialisation de données non fiables Aperçu CVE-2026-59827 est une vulnérabilité critique d'exécution de code à distance dans Metabase, la plateforme...

CVE-2026-39914

TIM Flow before 26.0.6 contains an improper authorization flaw in a privileged dashboard Excel export endpoint intended for administrative use only. Any authenticated user can submit arbitrary SQL queries to that endpoint, retrieving sensitive database contents as a downloadable spreadsheet and b...

The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49222

In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...

CVE-2026-49221

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

BIT-MASTODON-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive...

CVE-2026-16079

The CVE concerns the WordPress Fullscreen Galleria plugin (

CVE-2026-16586

CVE-2026-16586 affects the WordPress plugin “Contest Gallery” (all versions up to 30.0.7). It describes a Second-Order SQL Injection via the parameter cgRealId in the function path cg_multiple_files_for_post , caused by insufficient escaping of user input and lack of proper SQL query preparation....

PT-2026-72157

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8 Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-57621

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

EUVD-2026-55837

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914

Mastodon prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 exposes a resource exhaustion risk via administrative statistics endpoints (Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController). Anonymous callers can pass keys, start_at, and end_at to trigger long-running...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...