CVE-2026-111491

The MatchPoint Android app by TPC Software contains a vulnerability where credentials are stored in plain text within an SQLite database and the app's SharedPreferences . An attacker who gains access to the device's local data or a backup can retrieve usernames and passwords to gain unauthorized ...

CVE-2026-112913 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to place a database-wal or database-journa...

CVE-2026-112913

The filelock Python library (versions 3.20.4 to 4.2.1) contains a vulnerability in ReadWriteLock and AsyncReadWriteLock on Windows. The root cause is the use of _connect to attach SQLite to a lock database by pathname, which allows a local attacker to place database-wal or database-journal side f...

CVE-2026-112913 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to place a database-wal or database-journa...

CVE-2026-33944 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1value and localtax2value ...

CVE-2026-76181

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

DEBIAN-CVE-2026-76181

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

Bugs-feed

Bug's feed Bug's feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities... It's implemented as a PWA application so you can get rid of the explorer and use it as a desktop application. Navigate through different tabs and take a look to the latest bug...

CVE-2026-103021 OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds...

CVE-2026-91048

A flaw was found in Apache Karaf. Missing access control list ACL configurations for certain shell command scopes allow authenticated users with low privileges to execute administrative commands. By supplying a crafted database connection string to an unrestricted command, an attacker can trigger...

CVE-2026-103020 OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured...

CVE-2026-107384

A flaw was found in MariaDB Connector/Node.js. When the permitSetMultiParamEntries configuration setting is enabled, object keys are inserted into Structured Query Language SQL statements without proper escaping. A remote attacker can exploit this flaw by providing crafted input containing...

CVE-2026-107385

A flaw was found in MariaDB Connector/Node.js. When handling text-protocol database queries, the connector improperly escapes quote characters using backslashes without checking if the database session has backslash escaping disabled. A remote attacker can supply crafted input into query...

CVE-2026-115418

A flaw was found in @aws-cdk/aws-redshift-alpha. A SQL injection vulnerability in the database-query custom resource handlers allows an attacker capable of modifying construct property values to execute arbitrary SQL statements with superuser privileges on the Amazon Redshift cluster. By supplyin...

CVE-2026-111866

A flaw was found in manong. Due to improper input sanitization in the func.php script, the application is vulnerable to Structured Query Language SQL injection. A remote attacker can exploit this flaw by sending specially crafted input to affected database functions, allowing them to manipulate...

CVE-2026-110733

A flaw was found in the Apache SIS SQL storage module. When sorting a stream of features, the application appends sort clauses to database queries after the ORDER BY statement without properly quoting identifier characters. An attacker capable of supplying a crafted sort clause could exploit this...

CVE-2026-119675

A flaw was found in mongorestore within MongoDB Database Tools. This vulnerability allows an attacker to achieve privilege escalation by creating unauthorized database accounts, including accounts with full administrative root privileges. By providing a specially crafted database dump containing...

EUVD-2026-117767

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

CVE-2026-76181 Heap buffer overflow in dBASE index import

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

CVE-2026-76181

The LibreOffice dBASE database driver is vulnerable to a heap buffer overflow and uncontrolled recursion when processing dBASE tables and .ndx index files used as a data source. The flaw occurs because the driver fails to validate the number of entries recorded in an index page against the page's...