CLEANSTART-2026-XN67293 sqlparse is a non-validating SQL parser module for Python

CVE-2026-54284 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-HH21892 sqlparse is a non-validating SQL parser module for Python

CVE-2026-71491 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

Exploit for CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

Exploit for CVE-2026-101108

CVE-2026-101108 — OrdaSoft Vehicle Manager Free unauthentica...

Exploit for CVE-2026-100752

CVE-2026-100752 — OrdaSoft Real Estate Manager Free unauthen...

VulnCheck KEV: CVE-2015-20122

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

PT-2026-102628

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...

PT-2026-102623

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...

CVE-2026-102491: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...

PT-2026-102902

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...

CVE-2026-63713: Improper Neutralization of Special Elements used in an SQL Command

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

PT-2026-102499

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

PT-2026-102627

🚨 CVE-2026-102569 ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video moderation permission...

Linux Distros Unpatched Vulnerability : CVE-2026-53629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the...

PT-2026-102712

Name of the Vulnerable Software and Affected Versions Mediawiki - UserPageViewTracker Extension versions prior to 1.46.1 Mediawiki - UserPageViewTracker Extension version 1.45.5 Mediawiki - UserPageViewTracker Extension version 1.43.10 Description An unauthenticated SQL Injection occurs due to...

PT-2026-102631

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

CVE-2026-86843: Improper Neutralization of Special Elements used in an SQL Command

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-102909

The "supplier no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

CVE-2026-81930: Insufficiently Protected Credentials

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...