CVE-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

CVE-2026-55854

MariaDB Connector/Node.js can disclose an account password in cleartext when PAM dialog authentication is negotiated over an insecure transport. The root cause is in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, where SendPamAuthPacketFactory lacked the secu...

CVE-2026-55854 MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

CVE-2026-81533

CVE-2026-81533 is a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver . The root cause is the driver copying an unusually long digit sequence following a LIMIT clause into a fixed-size internal buffer without a length check. The issue is only reachable on connections where the d...

CVE-2026-81520

MongoDB Connector for BI is vulnerable to a denial-of-service condition caused by an unbounded SASL authentication negotiation loop . A network-reachable, unauthenticated client can initiate a SASL-based login exchange and then decline to complete it. Because the negotiation loop had no overall t...

CVE-2026-82263

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

CVE-2026-77586

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can...

CVE-2026-77184

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-76798

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-81518

mongosqld in the MongoDB BI Connector contains a TLS misconfiguration: when a client certificate authority file is configured, the listener requests a client certificate during the TLS handshake but does not require it. In deployments where client certificates serve as the sole authentication mec...

xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Esecuzione di Codice in Remoto Le versioni 3.15 e precedenti di Xerte Online Toolkits presentano 3 vulnerabilità nel componente /editor/elfinder/php/connector.php, che possono essere concatenate da un attaccante non autenticato per ottenere l'esecuzione di codice in...

CVE-2026-81517

CVE-2026-81517 affects MongoDB Connector for BI (mongosqld) . An unauthenticated network attacker can exhaust storage on the configured log path simply by generating routine connection log activity. When a subsequent log write or rotation fails, the error is not handled , causing the shared mongo...

CVE-2026-81490

MongoDB Connector for BI (mongosqld) contains an improper error handling flaw in its schema-sampling routine. A database user who can create a view in a sampled namespace can define a view whose evaluation reliably fails. The sampling logic misclassifies the resulting server message as transient ...

informer

Informer – Telegram-Massenüberwachung Update 10-20-2025 Sicherheit : Behobene kritische Sicherheitslücke CVE-2022-1941 in mysql-connector-python Sicherheit : Migration von veraltetem oauth2client zu google-auth Alle Abhängigkeiten auf die neuesten sicheren Versionen aktualisiert Fehler im...

CVE-2026-77586 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can...

EUVD-2026-67780

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can...

CVE-2026-77586

In MongoDB Connector for BI , object names (collections, fields, indexes) are embedded into the DDL output of SHOW CREATE statements without escaping the identifier delimiter. A user with write access to a sampled collection can craft a name that closes the quoted identifier early, injecting arbi...

EUVD-2026-67779

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-77184

MongoDB Connector for BI is affected by an incomplete escaping flaw: the description text of a collection's JSON schema validator is incorporated into the comment text of DDL returned by SHOW CREATE statements without fully escaping backslash characters. An attacker with permission to modify a co...