MariaDB: MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion

A heap buffer overflow vulnerability was discovered in the hatina::chainappend function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a...

Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure Detection

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Modern Events Calendar Lite before 5.""" from kittysplo...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances...

CVE-2026-65461

The WordPress plugin Really Simple CSV Importer (vulnerable:

CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

CVE-2026-65461: Unrestricted Upload of File with Dangerous Type

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Really Simple CSV Importer versions = 1.3...

EUVD-2026-46946

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: CSV Management. The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation...

CVE-2026-60584: Improper Access Control

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: CSV Management. The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation...

PT-2026-62626

Name of the Vulnerable Software and Affected Versions Oracle Transportation Management version 6.5.3 Description An issue exists in the CSV Management component of the Oracle Transportation Management product of Oracle Supply Chain. A low privileged attacker with network access via HTTP can explo...

[SECURITY] Fedora 43 Update: yq-4.53.3-1.fc43

Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor...

CVE-2026-54243

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula...

CVE-2026-54243 Statamic: CSV formula injection in form submission exports

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula...

CVE-2026-54243

CVE-2026-54243 affects Statamic CMS (Laravel/Git-powered). Prior to 5.73.24 and 6.20.1, form submission values exported to CSV via CsvExporter.php were not neutralized for spreadsheet formula characters. A value starting with =, +, -, or @ could be interpreted as a live formula when an editor ope...

CVE-2026-54243

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula...

CVE-2026-54243 Statamic: CSV formula injection in form submission exports

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula...

CVE-2026-63101 Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...