PYSEC-2026-2133

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose...

CVE-2026-28438 CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose...

CVE-2026-28438 CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose...

CVE-2026-28438 CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose...

CVE-2026-28438

CVE-2026-28438 affects CocoIndex: Doris target connector before 0.3.34 did not validate the configured table name when constructing ALTER TABLE statements, enabling SQL injection if a table name from an untrusted upstream is used during schema changes. The issue has been patched in version 0.3.34...

CVE-2026-28438

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose...

CVE-2025-69650

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents may pass ...

PT-2026-23694

Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the ID parameter. Attackers can send GET requests to wcategory.php with crafted SQL payloads in the ID parameter to...

CVE-2025-69650

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents may pass ...

CocoIndex SQL注入漏洞

CocoIndex is an open-source high-performance framework for AI data conversion developed by CocoIndex. Versions of CocoIndex prior to 0.3.34 contained a SQL injection vulnerability. This vulnerability occurred because the Doris target connector did not validate the configured table names, which...

PT-2026-23740

Name of the Vulnerable Software and Affected Versions GNU Binutils versions through 2.46 Description The software contains a double free issue when processing specially crafted ELF binaries with incorrect relocation data. Specifically, during Global Offset Table GOT relocation processing, the dum...

CVE-2025-69650

CVE-2025-69650 affects GNU Binutils up to version 2.46, specifically the readelf tool. The vulnerability arises during GOT relocation handling: dump_relocations may return early and fail to initialize the all_relocations array, causing process_got_section_contents() to pass an uninitialized r_sym...

ROS-20260306-73-0017

A vulnerability in the atomctrlinitializemcregtable function of the Linux kernel is related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

PT-2026-23684

Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to the ajax/load proveedores.php endpoint with crafted SQL payloads to extract sensitiv...

CVE-2025-69650

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents may pass ...

CVE-2025-69650

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents may pass ...

NewStart CGSL MAIN 6.06 (SP) : kernel Vulnerability (NS-SA-2026-0028)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has kernel packages installed that are affected by a vulnerability: - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpuobject.c misinterprets the drmgemshmemgetsgtable return value expects it to be NULL in the error case,...

CVE-2026-28222 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting XSS vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock...

CVE-2026-28222 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting XSS vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005599)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005599 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...