CVE-2026-69085: Improper Neutralization of Special Elements used in an SQL Command

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or...

CVE-2026-69084: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2026-67342

ArcadeDB is affected in versions before 26.7.2 where an authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints, failing to validate database access permissions. Attackers can call affected endpoints with arbitrary database parameters to access and m...

OESA-2026-3220 rubygem-msgpack security update

MessagePack is a binary-based efficient object serialization library. It enables to exchange structured objects between many languages like JSON. But unlike JSON, it is very fast and small. Security Fixes: Affected versions of this package are vulnerable to Use After Free in the clear function. A...

SQL-Injection-Vulnerability

SQL Injection Payload List SQL Injection I...

CVE-2026-14843 Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

CVE-2026-14843

The Events Made Easy WordPress plugin versions before 3.1.4 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a requester is authorized to modify a targeted record when processing unauthenticated data-change requests. Because the system relies solely on a...

WordPress Events Made Easy plugin < 3.1.4 - Unauthenticated Person Data Modification vulnerability

Unauthenticated Person Data Modification vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.4...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification vulnerability

Contributor+ Appointment Data Disclosure & Modification vulnerability discovered by Youssef massoudi in WordPress Plugin Easy Appointments versions = 3.12.26...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

CVE-2026-4604

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the krmrstoresettings function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2026-7769

CVE-2026-7769 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). Root cause: SQL injection in the backend database interface. Impact: remote attacker could view, add, modify, or delete data in the back-end DB. CVSS...

Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: Update to upstream tag jdk-25.0.4+7 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with netwo...

The vulnerabilities of the CIFS file system modules such as fs/cifs/cifsdebug.c, fs/cifs/cifsdebug.h, fs/cifs/connect.c, and fs/cifs/sess.c in the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the CIFS file system modules such as fs/cifs/cifsdebug.c, fs/cifs/cifsdebug.h, fs/cifs/connect.c, and fs/cifs/sess.c in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability allows a remote attacker to compromise...

Oracle MySQL J Connector (July 2026 CPU)

The 9.7.x versions of MySQL Connector/J installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 9.7.0-9.7.1...

CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...