DRUPAL-CONTRIB-2026-136

The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries,...

DRUPAL-CONTRIB-2026-134

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...

apache-auth-bypass-poc

CVE-2026-1337 - Apache WebPortal SQL Injection PoC Proof of C...

CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788

CVE-2026-85788 affects the mutable SQL detector component in Amazon awslabs mysql-mcp-server . An incomplete list of disallowed inputs allows context-dependent actors to bypass the read-only enforcement gate by crafting SQL inline comments that the regex engine does not treat as whitespace, reach...

EUVD-2026-75104

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

virtuoso-opensource: Openlink Virtuoso-opensource: Denial of Service via crafted SQL statements

A flaw was found in openlink virtuoso-opensource. This vulnerability allows an attacker to cause a Denial of Service DoS, meaning the service becomes unavailable to legitimate users. This can be achieved by sending specially crafted SQL statements to the sqlonaturaljoincond component, disrupting...

Important: Red Hat Security Advisory: virtuoso-opensource security update

An update for virtuoso-opensource is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

EUVD-2026-75062

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

CVE-2026-67401

A SQL injection vulnerability in cPanel's EmailTrack component allows a mail-enabled hosting account to achieve remote code execution as root . Affected versions include 11.110, 11.134, 11.136, 11.138 , and WP Squared 11.138.1.9 , or any build below the patched version. The CVSS score is 9.9 (Cri...

Vulnerabilities in Adobe ColdFusion

Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...

Exploit for CVE-2026-79387

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Manageme...

WordPress Quotes llama plugin < 3.1.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pablo González Pérez in WordPress Plugin Quotes llama versions 3.1.6...

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Mael MARTIN, Othmane EL AYADI in WordPress Plugin Verified Reviews Avis Vérifiés versions = 2.4.6...

CVE-2026-87807

siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...

CVE-2026-87808

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...