43 matches found
CVE-2026-119376
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...
CVE-2026-119419
CakePHP versions through 5.4.3 are vulnerable to an SQL Injection flaw in the StringExpression and IdentifierExpression components. The root cause is the use of unvalidated collation values; an attacker who controls a collation name passed to the constructor or the setCollation() method can appen...
EUVD-2026-113787
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...
CVE-2026-119376
Versions of SQLite prior to 3.54.0 are vulnerable to a stack exhaustion vulnerability caused by uncontrolled recursion in the sqlite3WalkExprNN() function. An attacker can bypass the SQLITE_LIMIT_EXPR_DEPTH limit by supplying approximately 175,000 chained COLLATE postfix operators within an SQL q...
CVE-2026-119376 SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...
PT-2026-133460
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE LIMIT EXPR DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursio...
sqlite-collate-depth
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-collate-depth Write-up: https://abraxaslabs.tech/research/sqlite-collate-depth sqlite-collate-depth Class: Crash Reach: Local SQLite 3.53.4 b09c88c14082339b66c7b7158d609a771e64ca69, SOURCEID 2026-07-24 19:02:57...
cakephp-collate-sqli
abraxaslabs.tech · github.com/abraxas ·&...
collate-sqllineage (>=1.1.5, <=1.2.4), openmetadata-ingestion (>=1.0.0.0, <=1.0.1.3) +3 more potentially affected by CVE-2026-46373 via sqlfluff (2.1.4)
sqlfluff PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.1.5, =1.0.0.0, =1.0.1.3 - openmetadata-sqllineage 1.1.2.0 - sqlfluff-templater-dbt 2.1.4 - sqllineage 1.4.7 Source cves:...
apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46373 via sqlfluff (3.0.7)
sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46373 Source...
apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46374 via sqlfluff (3.0.7)
sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46374 Source...
collate-sqllineage (>=1.6.4, <=1.6.7), dbt-coves (>=1.1.1a1, <=1.1.1a6) +2 more potentially affected by CVE-2026-46373 via sqlfluff (3.1.1)
sqlfluff PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.6.4, =1.1.1a1, =1.1.1a6 - sqlfluff-templater-dataform 0.1.0 - sqlfluff-templater-dbt 3.1.1 Source cves: CVE-2026-46373...
collate-sqllineage (>=1.2.5, <=1.3.0), custom-connector (>=0.0.1, <=0.0.2) +13 more potentially affected by CVE-2026-46374 via sqlfluff (2.3.5)
sqlfluff PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.2.5, =0.0.1, =1.3.3, =0.3.1, =0.1.11, =0.1.26, =1.2.3.3, =0.0.1, =1.4.9, =0.1.0, =0.3.0 Source cves: CVE-2026-46374 Source...
collate-sqllineage (>=1.1.5, <=1.2.4), openmetadata-ingestion (>=1.0.0.0, <=1.0.1.3) +3 more potentially affected by CVE-2026-46374 via sqlfluff (2.1.4)
sqlfluff PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.1.5, =1.0.0.0, =1.0.1.3 - openmetadata-sqllineage 1.1.2.0 - sqlfluff-templater-dbt 2.1.4 - sqllineage 1.4.7 Source cves:...
apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46374 via sqlfluff (3.0.7)
sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46374 Source...
collate-sqllineage (>=1.6.4, <=1.6.7), dbt-coves (>=1.1.1a1, <=1.1.1a6) +2 more potentially affected by CVE-2026-46374 via sqlfluff (3.1.1)
sqlfluff PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.6.4, =1.1.1a1, =1.1.1a6 - sqlfluff-templater-dataform 0.1.0 - sqlfluff-templater-dbt 3.1.1 Source cves: CVE-2026-46374...
collate-sqllineage (>=1.6.8, <=1.6.10), sqlfluff-templater-dbt (3.3.1) +2 more potentially affected by CVE-2026-46374 via sqlfluff (3.3.1)
sqlfluff PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.6.8, =1.6.10 - sqlfluff-templater-dbt 3.3.1 - sqllineage 1.5.4 - txt2sql 0.2.0 Source cves: CVE-2026-46374 Source advisory...
collate-sqllineage (>=1.1.5, <=1.2.4), openmetadata-ingestion (>=1.0.0.0, <=1.0.1.3) +3 more potentially affected by CVE-2026-46373 via sqlfluff (2.1.4)
sqlfluff PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.1.5, =1.0.0.0, =1.0.1.3 - openmetadata-sqllineage 1.1.2.0 - sqlfluff-templater-dbt 2.1.4 - sqllineage 1.4.7 Source cves:...
apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46373 via sqlfluff (3.0.7)
sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46373 Source...
collate-sqllineage (>=1.6.4, <=1.6.7), dbt-coves (>=1.1.1a1, <=1.1.1a6) +2 more potentially affected by CVE-2026-46373 via sqlfluff (3.1.1)
sqlfluff PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.6.4, =1.1.1a1, =1.1.1a6 - sqlfluff-templater-dataform 0.1.0 - sqlfluff-templater-dbt 3.1.1 Source cves: CVE-2026-46373...