CVE-2026-50180 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses...

dbt (0.18.2), dbt-bigquery (0.18.2) +9 more potentially affected by CVE-2024-36105 via dbt-core (0.18.2)

dbt-core PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.2 - dbt-bigquery 0.18.2 - dbt-clickhouse =0.18.2, =0.18.0rc1, =0.0.1, =0.18.1, =0.18.2 Source cves: CVE-2024-36105 Source advisory:...

CVE-2025-64298: Incorrect Permission Assignment for Critical Resource

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and...

CVE-2025-10702

Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...

cl.kanopus.tool:ktool-deploy-sql (1.0.0), cl.kanopus.util:klib-deploy-sql (3.0.0) +109 more potentially affected by CVE-2025-59250 via com.microsoft.sqlserver:mssql-jdbc (>=12.10.0.jre11, <=12.10.2.jre8)

com.microsoft.sqlserver:mssql-jdbc MAVEN version =12.10.0.jre11, =0.7.0, =0.7.0, =1.25.2, =4.4.4, =0.0.9, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-59250 Source advisory: OSV:GHSA-M494-W24Q-6F7W...

io.github.regychang:flinkify-flink-core (>=0.2.1, <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

io.github.regychang:flinkify-flink-core (>=0.2.1, <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

io.github.regychang:flinkify-flink-core (>=0.2.1, <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

io.github.regychang:flinkify-flink-core (>=0.2.1, <=0.2.2) potentially affected by CVE-2025-62228 via org.apache.flink:flink-connector-sqlserver-cdc (3.2.0)

org.apache.flink:flink-connector-sqlserver-cdc MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-connector-sqlserver-cdc and may be impacted: - io.github.regychang:flinkify-flink-core =0.2.1, =0.2.2 Source cves:...

EUVD-2018-0728

Malware in sbrugna...

EUVD-2023-50804

Malicious code in bioql PyPI...

Malicious code in catbox-sqlserver (npm)

The package catbox-sqlserver was found to contain malicious code...

MAL-2025-16660 Malicious code in catbox-sqlserver (npm)

The package catbox-sqlserver was found to contain malicious code...

CVE-2023-46601

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...

io.debezium:debezium-connector-mongodb (1.0.0.beta1), io.debezium:debezium-connector-mysql (1.0.0.beta1) +5 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.0.0.beta1)

io.debezium:debezium-core MAVEN version 1.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-mongodb 1.0.0.beta1 - io.debezium:debezium-connector-mysql 1.0.0.beta1 -...

org.apache.camel.quarkus:camel-quarkus-debezium-sqlserver (>=2.9.0, <=2.10.0), org.apache.camel.quarkus:camel-quarkus-debezium-sqlserver-deployment (>=2.9.0, <=2.10.0) potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.9.2.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - org.apache.camel.quarkus:camel-quarkus-debezium-sqlserver =2.9.0, =2.9.0,...

org.apache.camel.springboot:camel-debezium-sqlserver-starter (>=3.18.0, <=3.18.1), org.apache.camel:camel-debezium-sqlserver (>=3.18.0, <=3.18.1) potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.9.4.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - org.apache.camel.springboot:camel-debezium-sqlserver-starter =3.18.0,...

io.debezium:debezium-connector-db2 (1.8.0.alpha1), io.debezium:debezium-connector-mongodb (1.8.0.alpha1) +19 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.8.0.alpha1)

io.debezium:debezium-core MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-db2 1.8.0.alpha1 - io.debezium:debezium-connector-mongodb 1.8.0.alpha1 ...

io.debezium:debezium-connector-db2 (1.7.1.final), io.debezium:debezium-connector-mongodb (1.7.1.final) +48 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.7.1.final)

io.debezium:debezium-core MAVEN version 1.7.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-db2 1.7.1.final - io.debezium:debezium-connector-mongodb 1.7.1.final -...

io.kestra.plugin:plugin-debezium-sqlserver (0.4.1) potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.9.0.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - io.kestra.plugin:plugin-debezium-sqlserver 0.4.1 Source cves: CVE-2023-14...