Linux Distros Unpatched Vulnerability : CVE-2026-72558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The...

PT-2026-71233

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities

The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...

PT-2026-71038

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

PT-2026-71115

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-62901

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2026-53413

creationtimestamp| type| source ---|---|--- 2026-08-11 19:30:25+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mste2cxxxs2i 2026-08-11 19:39:32+00:00| seen| https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mstekmt5rz2z 2026-08-11 23:11:02+00:00| seen|...

CVE-2026-18690

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper...

UBUNTU-CVE-2026-18690

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper...

CVE-2026-18698

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-73211

PeerTube (ActivityPub-federated video platform) pre-8.1.6 is affected by an unauthenticated remote SQL injection in ActorFollowModel.updateScore(), where the attacker-controlled inboxUrl is interpolated into an SQL query. This allows reading and writing of database tables, including oAuthToken.ac...

CVE-2026-73211 PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...

CVE-2026-48771

CVE-2026-48771 affects the ishankportfolio site prior to version 1.0.1, where a misconfigured client-side database and permissive access policies could allow unauthenticated readers to read, modify, or abuse stored contact form submissions. The impact includes exposure of PII such as names, email...

EUVD-2026-56785

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-63522

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

DEBIAN-CVE-2025-31938

Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentiall...

EUVD-2026-56769

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability

...

CVE-2026-63522

Azure SQL Database is the affected product for CVE-2026-63522, described as an incorrect permission assignment for a critical resource that allows an authorized attacker to elevate privileges locally. The issue has a base CVSSv3.1 score of 7.8 (HIGH) with LOCAL access, low attack complexity, and ...