CVE-2026-89287: Improper Neutralization of Special Elements used in an SQL Command

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...

PT-2026-110118

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2 Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allow...

CVE-2026-108871: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108870: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

flatpak security update

1.16.0-9.4 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271519 1.16.0-9....

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-108639

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-108629

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108627

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108614

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...

CVE-2026-108639 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-108639

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysDictController component. Specifically, the deletePhysic handler fails to perform adequate permission checks, allowing any authenticated user to send DELETE requests to /sys/dict/deletePhysic/{id}. This vuln...

CVE-2026-108639 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-108640

The JeecgBoot framework, versions through 3.9.5 , contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController queryById handler. The root cause is the absence of necessary Shiro permission annotations , which allows low-privileged authenticated attackers to perform una...

CVE-2026-108629

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler within the SysDepartPermissionController. This vulnerability allows any authenticated user to perform unauthorized actions on department data rules. By sending departId, permissionId, and d...

CVE-2026-108629 JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...