CVE-2026-121009

A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...

CVE-2026-91163

The Warpgate bastion host (versions prior to 0.29.0 ) contains a vulnerability in its Kubernetes protocol listener. The component warpgate-protocol-kubernetes/src/server/client_certs.rs uses AcceptAnyClientCert to accept certificates at the TLS layer, deferring validation to warpgate-protocol-kub...

CVE-2026-91163 Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/clientcerts.rs to accept certificates at the TLS layer and defer validation to...

CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP versions prior to 4.4.29 are vulnerable to an Authenticated SQL Injection flaw on the /ecrire/?exec=articles endpoint. The vulnerability is caused by a request parameter mismatch where a differing where parameter value provided in the POST body versus the GET query string allows attackers to...

CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

EUVD-2026-116939

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122007 Oqtane Framework before 10.3.0 Broken Access Control via SettingController

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type...

CVE-2026-90627

The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

CVE-2026-90627

The flat file database driver in Apache OpenOffice (versions through 4.1.16 ) is vulnerable to a local file inclusion flaw. A crafted document can be used to read the contents of any local file without prompting the user. To remediate this issue, users are recommended to upgrade to version 4.1.17 .

CVE-2026-90627 Apache OpenOffice: Local file inclusion via SQL provider and flat file database references

The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

EUVD-2026-116876

The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

CVE-2026-115262

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL int...

CVE-2026-115241

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other...

EUVD-2026-116730

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL int...

CVE-2026-115262

The Duplicator and duplicator-pro WordPress plugins (versions before 5.1.0 ) are vulnerable to a SQL Injection flaw. The root cause is that the plugins fail to restrict database charset and collation rewrites to schema statements during a restore operation. A Subscriber can store a malicious valu...

CVE-2026-115262 Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL int...

CVE-2026-115241

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.137 is vulnerable to arbitrary database table deletion. The root cause is a failure to verify that a submitted snapshot identifier refers to a snapshot actually created by the user before using it as a database table-na...

CVE-2026-115241 WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other...