EUVD-2026-68402

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

PT-2026-83750

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.0.0-ee-beta.2 Description An authorization bypass exists in the 'POST /api/v2/resources/export' endpoint. Authenticated users can disclose TooljetDB table schemas across workspace boundaries or export app definition...

PT-2026-83744

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

Linux Distros Unpatched Vulnerability : CVE-2025-71346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the...

Linux Distros Unpatched Vulnerability : CVE-2023-54354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in X...

CVE-2026-78699

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

EEF-CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Summary Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-78699

ash_postgres (ash-project) versions 0.25.0 through 2.12.0 are affected by an unchecked return value in AshPostgres.MultiTenancy.rename_tenant/3. The function issues ALTER SCHEMA … RENAME TO … via the non-raising Ecto.Adapters.SQL.query/2, discards the result, and unconditionally returns :ok. When...

CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Summary Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the...

CVE-2026-81318

ash-project ash_sql (an Elixir SQL adapter for the Ash framework) contains an incorrect authorization flaw in AshSql.AggregateQuery.add_single_aggs/5. When computing an aggregate over a distinct query , the outer query is rebuilt from query.from.source alone, dropping the query.prefix / query.fro...

MAL-2026-15595 Malicious code in generate-schema-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b43ea1e723ebd0c0ef5c4cd564b106089f9b5f9fd119dcac26dc1e130a14bf Package publishes as generate-schema-viem but exposes a bin named generate-schema-ethers a dependency-confusion / typosquat shape against the...

Malicious code in generate-schema-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b43ea1e723ebd0c0ef5c4cd564b106089f9b5f9fd119dcac26dc1e130a14bf Package publishes as generate-schema-viem but exposes a bin named generate-schema-ethers a dependency-confusion / typosquat shape against the...

Malicious code in generate-schema-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 794f10449a8a47c4428b68edcff212be94917e229322394e9dda43e4c5b2b2e0 On require/npx invocation, bin/cli.js runs whoami and POSTs the OS username, hostname, platform, and package name as JSON to the hardcoded URL...

MAL-2026-15594 Malicious code in generate-schema-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 794f10449a8a47c4428b68edcff212be94917e229322394e9dda43e4c5b2b2e0 On require/npx invocation, bin/cli.js runs whoami and POSTs the OS username, hostname, platform, and package name as JSON to the hardcoded URL...

MiracleLinux 8 : mysql:8.4 (AXSA:2026-1695:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1695:01 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-470...

EUVD-2026-67931

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configure...