CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

EUVD-2026-86399

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...

EUVD-2026-86395

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

CVE-2026-97321 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-97321

The YunaiV/zhijiantianya ruoyi-vue-pro software (up to version 2026.08) contains a SQL injection vulnerability in the GoView Data Endpoint component. Specifically, the GoViewDataServiceImpl.getDataBySQL function in the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/...

EUVD-2026-86388

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-61825

The code16/sharp Laravel-based framework is vulnerable to stored cross-site scripting (XSS) in versions before 9.22.5 . The flaw exists within the SharpEditorFormField component, where attacker-controlled content using the data-html-content attribute can bypass HTML sanitization to preserve and e...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-82371

Brocade SANnav versions before 3.0.1a are vulnerable to a plaintext exposure of sensitive authentication data within the discovery service log files . This flaw allows individuals with file read access to retrieve administrative switch credentials and active session tokens . An attacker who gains...

EUVD-2026-86349

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

CVE-2026-82371 Plaintext exposure of sensitive authentication data in SANnav discovery service log files

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed...

EUVD-2026-86347

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

markdown-exfil-tester

valtik-markdown-exfil-tester LLM ベースのチャットボットにおける、間接的プロンプトインジェクションによるマークダウン / HTML 外部送信（exfiltration） のためのブラックボックステスターです。これは、Microsoft 365 Copilot（CVE-2025-32711、通称 EchoLeak）、ChatGPT（OpenAI の 2026 年 2 月パッチ）、Salesforce（ForcedLeak）で発生した脆弱性クラスです。そのパターンは次のとおりです。 1. 攻撃者は、LLM...

CVE-2025-56801

CVE-2025-56801 Reolink デスクトップアプリケーションにおける AES-CFB IV 生成の脆弱性 1. 概要 名称 : Reolink デスクトップアプリケーション バージョン : 8.18.12 ベンダー : Reolink CWE : CWE-1204: 弱い初期化ベクトルIVの生成, CWE-321: ハードコードされた暗号鍵の使用 CVSS : 5.1 MEDIUM ベクター文字列 : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L 2. 概要 Reolink デスクトップアプリケーションバージョン...

CVE-2026-35678

脆弱性調査レポート: All Eduplus Student ERP の安全でない直接オブジェクト参照 IDOR 研究者: Vinay Sharma 1. エグゼクティブサマリー 本レポートは、Eduplus Student ERP プラットフォーム、特に学生学習者ポータル learnerapi.pceterp.in において特定された高深刻度のセキュリティ脆弱性について詳述するものです。本アプリケーションは、試験フォーム提出エンドポイントに普遍的な安全でない直接オブジェクト参照 IDOR の脆弱性を抱えており、認証された任意のユーザー 学生...

CVE-2026-32247

CVE-2026-32247 — Cypher Injection in graphiti-core via unsanitized nodelabels Severity : High CVSS 8.1 CWE : CWE-943 — Improper Neutralization of Special Elements in Data Query Logic Affected : graphiti-core = 0.28.1 pip Fixed in : 0.28.2 Advisory : GHSA-gg5m-55jj-8m5g NVD :...