58536 matches found
CVE-2026-10716
Directus: Authenticated SQL injection in collection creation when using PostgreSQL with PostGIS. A admin can craft a collection with a geometry field where fields[].type starts with geometry but includes attacker-controlled SQL syntax after the geometry subtype, enabling time-based SQL injection....
CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
CVE-2026-70604
creationtimestamp| type| source ---|---|--- 2026-08-05 16:31:30+00:00| seen| https://gist.github.com/alon710/833f29b9d380bcf059ea629581974a6e...
GHSA-7PGQ-CR25-XVC8
creationtimestamp| type| source ---|---|--- 2026-08-05 16:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364 2026-08-06 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364...
CVE-2026-71278
creationtimestamp| type| source ---|---|--- 2026-08-05 15:02:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdsay4d2z2h...
CVE-2026-16496
creationtimestamp| type| source ---|---|--- 2026-08-05 15:00:06+00:00| seen| https://t.me/thehackernews/9717 2026-08-06 00:00:33+00:00| seen| https://t.me/thehackernews/9717...
CVE-2026-71268
creationtimestamp| type| source ---|---|--- 2026-08-05 14:58:17+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdrzssxzv22...
Malicious code in delivery-ci-sage (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...
CVE-2026-71256
creationtimestamp| type| source ---|---|--- 2026-08-05 13:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdnoeonar2o...
GHSA-PWXH-7358-JQ2X
creationtimestamp| type| source ---|---|--- 2026-08-05 13:31:17+00:00| seen| https://gist.github.com/alon710/63aaf77a9f4550ada3647ec00940f1b7...
CVE-2026-71278
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-16022
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...
CVE-2026-71278
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-71278 rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
EUVD-2026-53363
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary script field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored scri...
CVE-2026-71245
creationtimestamp| type| source ---|---|--- 2026-08-05 12:14:36+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msdivizqws2r 2026-08-05 12:14:37+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117042844511124715...
CVE-2026-16022 Command Injection in @oblique/cli
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...
CVE-2026-16022
Summary: CVE-2026-16022 affects @oblique/cli v15.4.0, where project creation composes shell commands by string concatenation and executes them with execSync(). A user-controlled project-name argument is directly interpolated into the shell command without proper neutralization, enabling shell met...
EUVD-2026-53335
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...