EUVD-2026-57846

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-15741

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

EUVD-2026-57847

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

CVE-2026-15741

CVE-2026-15741 describes an SQL injection vulnerability in PostgreSQL via the EXTRACT() deparse path, where an object owner can execute arbitrary SQL as a superuser through a hostile object definition. Affected are expressions deparse consumers, including non-core tools like pg_dump and psql comm...

CVE-2026-15741

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CLEANSTART-2026-KC96979 Security fixes in temporal-server 1.31.1-r2

Package temporal-server version 1.31.1-r2 fixes 8 vulnerabilities: ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772, ghsa-xpg8-3hhp-p7w8, CVE-2025-14987...

CLEANSTART-2026-OX91928 Security fixes in sqlpad 7.5.7-r5

Package sqlpad version 7.5.7-r5 fixes 1 vulnerabilities: ghsa-r292-9mhp-454m...

CLEANSTART-2026-VJ19248 Security fixes in sqlpad 7.5.7-r3

Package sqlpad version 7.5.7-r3 fixes 26 vulnerabilities: ghsa-2v35-w6hq-6mfw, ghsa-f6ww-3ggp-fr8h, ghsa-wh4c-j3r5-mjhp, ghsa-x6wf-f3px-wcqx, ghsa-j759-j44w-7fr8...

WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin CubeWP versions = 1.1.30...

CVE-2026-11840

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840 SQL Injection

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840

Affected software : Zohocorp ManageEngine Password Manager Pro (versions before 13232) and ManageEngine PAM360 (versions before 8552). Vulnerability : authenticated SQL injection in these products. Root cause/impact : vulnerability exists in auth context allowing SQL injection with user credentia...

EUVD-2026-57740

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840 SQL Injection

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...

PT-2026-71577

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

PT-2026-76570

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...