Linux Distros Unpatched Vulnerability : CVE-2026-102523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT...

CVE-2026-102523

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

UBUNTU-CVE-2026-102523

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

CVE-2026-61650

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/moduleName/id/relationships/linkFieldName endpoint checks only view and list permissions before a one-to-many relationship writes a target...

CVE-2026-102523

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

CVE-2026-102523 MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

CVE-2026-102523 MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

EUVD-2026-117548

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

CVE-2026-102523

In MariaDB server versions 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1 through 13.0.1, an authorization bypass exists due to missing filename encoding in the ALTER TABLE ... CONVERT ... PARTITION statement. An authenticated database u...

alter-zero

Alter Zero Give your terminal a coding agent. Read, build, debug, and review code with an agent that works alongside you. Use the same tools for cybersecurity research, technical investigation, and everyday automation. Quick start · Features · Model providers · Commands & shortcuts · Support ·...

radioguard

RadioGuard: Zero-Trust Cellular Defense Sub-Service for Android RadioGuard is an open-source, production-ready Android security application and background sub-service. It actively detects rogue cell towers IMSI-catchers / Cell-Site Simulators / SMS Blasters, identifies hostile 2G/4G cellular...

phpmyadmin-auth-plugin-unquoted

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-auth-plugin-unquoted Write-up: https://abraxaslabs.tech/research/phpmyadmin-auth-plugin-unquoted phpmyadmin-auth-plugin-unquoted Class: SQLi Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin...

CVE-2026-119575

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

EUVD-2026-113929

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575

ArcadeDB versions 26.8.1 before 26.10.2 are vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows authenticated users with updateDatabaseSettings permissions to disable the LOAD CSV IP block list using the ALTER DATABASE command. By setting arcadedb.opencypher.loadCsv.blo...

PT-2026-133544

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated…

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-117606

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...