iTop Hub Connector - Information Disclosure

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. id: CVE-2024-32870 info: name: iTop Hub...

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

MountDev AI MCP Connector for WordPress mountdev-ai-mcp-connector = 1.6.1 is vulnerable to unauthenticated authorization bypass CWE-862 via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint /mcp-register at WordPress init-level that allows...

powersap

PowerSAP PowerSAP is a simple powershell re-implementation of popular & effective techniques of all public tools such as Bizploit, Metasploit auxiliary modules, or python scripts available on the Internet. This re-implementation does not contain any new or undisclosed vulnerability. PowerSAP allo...

Python-exploit-CVE-2020-25213

Description The File Manager wp-file-manager plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload or...

informer

Informer - Telegram Mass Surveillance Update 10-20-2025 Security : Fixed high-severity vulnerability CVE-2022-1941 in mysql-connector-python Security : Migrated from deprecated oauth2client to google-auth Updated all dependencies to latest secure versions Fixed quickstart.sh script bugs venv...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis References Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC Deserialization Analysis - 跳跳糖 tttang.com Vulnerability Overview Vulnerability in...

CVE-2026-123859

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

EUVD-2026-118319

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859

The Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) are vulnerable to SQL injection via the write_pandas() data-loading functionality. When identifier escaping is disabled through a non-default configuration, the software fails to escape DataFrame column names b...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

K000164143: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-74049 Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was create...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...

Atlassian Confluence Server - Path Traversal

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 the fixed version for 6.6.x, from version 6.7.0 before 6.12.3 the fixed version for 6.12.x, from version 6.13.0 before 6.13.3 the fixed version for 6.13.x, and from version 6.14.0 before 6.14.2 the fixed version for...

CVE-2026-123859: Snowflake: When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality…

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-107384

A flaw was found in MariaDB Connector/Node.js. When the permitSetMultiParamEntries configuration setting is enabled, object keys are inserted into Structured Query Language SQL statements without proper escaping. A remote attacker can exploit this flaw by providing crafted input containing...

CVE-2026-107385

A flaw was found in MariaDB Connector/Node.js. When handling text-protocol database queries, the connector improperly escapes quote characters using backslashes without checking if the database session has backslash escaping disabled. A remote attacker can supply crafted input into query...

CVE-2026-107383

A flaw was found in MariaDB Connector/Node.js. This vulnerability allows an attacker to cause an information disclosure of uninitialized application memory into the database. When processing geographic data in GeoJSON format, the connector allocates memory buffers before verifying data structures...

CVE-2026-116593

A flaw was found in Apache Kafka Connect. This vulnerability allows information disclosure when a remote attacker accesses the connector configuration validation endpoint. By submitting a request to this endpoint, an attacker can force installed configuration providers to resolve and return...

CVE-2026-121927

A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...