CVE-2026-16905

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...

EUVD-2026-58794

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...

CVE-2026-16905

CVE-2026-16905 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. Description: a remote authenticated attacker could obtain sensitive information due to improper authentication. CVSS v3.1 base score 5.3 (MEDIUM), vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Root cause: improper authenticat...

EUVD-2026-58786

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database CPDB workflow that copies survey participant tokens to the central participant list...

EUVD-2026-58745

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

CVE-2026-49989

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...

CVE-2026-19628

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

CVE-2026-19631 SQL Injection

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-19628 Remote Code Execution

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

CVE-2026-19628

CVE-2026-19628: A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying OS when specific backend operations are triggered. Supported metrics show a Hi...

EUVD-2026-58717

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...

CVE-2026-49989

CrateDB prior to 6.2.8 and 6.3.2 exposes an authorization bypass in the HTTP blob API. The HTTP path (GET/PUT/DELETE /_blobs/{table}/{digest}) authenticates requests but does not enforce privileges via AccessControl, unlike the SQL path. As a result, any authenticated user who knows a blob’s SHA-...

CVE-2026-73559

A flaw was found in vLLM, an inference and serving engine for large language models. An authenticated API client can exploit this vulnerability by sending a single request to the /v1/completions endpoint with an excessively large list of prompts. This unbounded input causes the vLLM server to...

EUVD-2026-58661

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

EUVD-2026-58649

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72835

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72834

CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...

CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...