PT-2026-51761

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 2.2.8 Description An authenticated user can execute arbitrary SQL commands, including blind and error-based data extraction from the credential table, due to insufficient validation of the id field in JSON import file...

SUSE CVE-2023-52970

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4. crashes in Itemdirectviewref::derivedfieldtransformerforwhere...

SUSE SLES15 : Recommended update for python3-M2Crypto (SUSE-SU-SUSE-RU-2025:0800-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:0800-1 advisory. - Fix spelling of BSD-2-Clause license. - Update to 0.44.0: - The real license is BSD 2-Clause, not MIT. - Remove...

SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for python3-M2Crypto (SUSE-SU-SUSE-RU-2025:0796-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:0796-1 advisory. - Fix spelling of BSD-2-Clause license. - Update to 0.44.0: - The real license is BSD 2-Clause, n...

DEBIAN-CVE-2023-52970

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4. crashes in Itemdirectviewref::derivedfieldtransformerforwhere...

UBUNTU-CVE-2023-52970

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4. crashes in Itemdirectviewref::derivedfieldtransformerforwhere...

SUSE-RU-2025:0796-1 Recommended update for python3-M2Crypto

This update for python3-M2Crypto fixes the following issues: - Fix spelling of BSD-2-Clause license. - Update to 0.44.0: - The real license is BSD 2-Clause, not MIT. - Remove python-M2Crypto.keyring, because PyPI broke GPG support - Build for modern python stack on SLE/Leap - require setuptools -...

Joomla! security vulnerabilities

Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions 4.0.0 through 4.4.10 and 5.1.0 through 5.2.3, which stems from an improperly constructed ORDER clause and can lead to SQL injection attacks...

CVE-2023-37039

A Null pointer dereference vulnerability in the Mobile Management Entity MME in Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allow network-adjacent attackers to crash the MME via an S1AP Initial UE Message packet missing an expected RRC Establishment Clause field...

Chatwoot SQL Injection Vulnerability

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A SQL injection vulnerability exists in Chatwoot versions prior to 3.16.0 that stems from improper input cleanup and allows an attacker t...

GHSA-27VQ-HV74-7CQP SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type

The OVERWRITE clause of the DEFINE TABLE statement would fail to overwrite data for tables that were defined with TYPE RELATION. Since table definitions include the PERMISSIONS clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to...

PT-2024-40015

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.4 Description The issue concerns the OVERWRITE clause of the DEFINE TABLE statement, which fails to overwrite data for tables defined with TYPE RELATION. This failure affects the PERMISSIONS clause, potentially...

PT-2026-60937

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.4 Description An issue exists where the system silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is applied to tables defined with TYPE RELATION. Since table definitions...

PT-2024-33345

Name of the Vulnerable Software and Affected Versions Querydsl version 5.1.0 OpenFeign Querydsl version 6.8 Description The issue allows SQL/HQL injection in the orderBy clause of JPAQuery. This is possible when untrusted input is directly used in query construction. Note that the Querydsl...

lunary SQL Injection Vulnerability

lunary is lunary open source a production toolkit for LLM . lunary suffers from a SQL injection vulnerability that stems from the use of sql.unsafe in the order by clause of a SQL query without prior cleanup. No detailed vulnerability details are provided at this time...

CVE-2024-7456

The CVE-2024-7456 issue affects lunary-ai/lunary v1.4.2, where the /api/v1/external-users route constructs an ORDER BY clause using sql.unsafe without server-side sanitization, enabling SQL injection. Impact per sources: potential complete data loss/modification/corruption. Public details across ...

CVE-2024-7456 SQL Injection in lunary-ai/lunary

A SQL injection vulnerability exists in the /api/v1/external-users route of lunary-ai/lunary version v1.4.2. The order by clause of the SQL query uses sql.unsafe without prior sanitization, allowing for SQL injection. The orderByClause variable is constructed without server-side validation or...

PT-2024-38366 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version v1.4.2 Description: A SQL injection vulnerability exists in the "/api/v1/external-users" route. The order by clause of the SQL query uses sql.unsafe without prior sanitization, allowing for SQL injection. The...

Lunary SQL injection vulnerability

lunary is lunary open source a production toolkit for LLM . lunary suffers from a SQL injection vulnerability that stems from the use of sql.unsafe in the order by clause of a SQL query without prior cleanup. No detailed vulnerability details are provided at this time...

SurrealDB: Improper Authorization in Select Permissions

Due to the order in which permissions were processed, some statements, filters and computations could lead to leaking field values or record contents to users without the required permissions. This behavior could be triggered in different scenarios: - When performing a SELECT operation on a table...