CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

CVE-2026-73663

The CVE concerns FreePBX missedcall module (affected in 16.0.0–16.0.11 and 17.0.4) where inbound Caller ID name from crafted SIP From headers is inserted into missedcalllog without escaping or bound parameters, enabling unauthenticated SQL injection that can corrupt the database and modify admini...

EUVD-2026-58486

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-73663

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

Exploit for SQL Injection in Metabase

CVE-2026-72898...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, ruby3.3-rails...

CVE-2026-73418 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: flyway, akhq, apicurio-registry, logstash, opensearch, kserve-modelmesh, sonarqube, zipkin, nrjmx, cassandra-reaper, druid, wavefront-proxy, thingsboard...

CVE-2026-73651

creationtimestamp| type| source ---|---|--- 2026-08-13 20:35:04+00:00| published-proof-of-concept| https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, pghero, ruby4.0-rails, gitlab-rails-ce-fips, pghero-fips, gitlab-rails-ce...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, pghero, ruby4.0-rails, gitlab-rails-ce-fips, pghero-fips, gitlab-rails-ce...

CVE-2026-72898 vulnerabilities

Vulnerabilities for packages: metabase...

CVE-2026-73418 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, langfuse-fips...

CVE-2026-16961

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-16967 IBM i is Affected By Multiple SQL Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use TOCTOU race condition involving symbolic links...

CVE-2026-16967

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-16967, a TOCTOU race condition involving symbolic links that could let a remote authenticated attacker gain unauthorized access to system objects. CVSS v3.1 base score 8.5 ( HIGH ) with network attack vector, high impact on confidenti...

CVE-2026-16961

IBM i versions 7.4, 7.5, and 7.6 (feature 5770-SS1) are vulnerable to CWE-89 SQL injection in Db2 Mirror, allowing remote attackers to view, add, modify, or delete back-end database data. IBM has issued PTFs SJ10902 (7.6), SJ10908 (7.5), and SJ10910 (7.4) as remediation; no workarounds are provid...