Denial Of Service (DoS)

sqlparse is vulnerable to Denial of Service DoS. The vulnerability is due to repeated rescanning of comment-only SQL statements before the grouping limit is enforced, which allows an attacker to provide crafted input that causes quadratic CPU consumption and degrades application performance...

PT-2026-80289

Vulnerability Details File: go/vt/vttablet/tabletmanager/vreplication/vrlog.go Summary vttablet's /debug/vrlog HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL...

CVE-2026-75479: Missing Authentication for Critical Function

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-15963

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

UBUNTU-CVE-2026-73194

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

EUVD-2026-58526

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-72550 Friendica Friendica - SQL Injection

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

CVE-2026-72550: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

POC_platform

🛡️ POC Management Platform Local POC/EXP Management Platform:...

Malicious code in bigops-statements-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316 On require of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating...

RLSA-2026:49612 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

SummaryA malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in the...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the StatementSyncIterator. An attacker can execute unintended SQL statements with altered parameters by leveraging a stale iterator after the underlying statement has been reset and...

CVE-2026-58041

CVE-2026-58041 affects Node.js with the node:sqlite integration. The issue: a stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters. The underlying cause is that SQLTagStore ...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

ALSA-2026:49514 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

PT-2026-67406

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or...