CVE-2026-121455 DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-4052

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

EUVD-2026-115721

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-120558

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...

CVE-2026-120563

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...

CVE-2026-120563 WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...

CVE-2026-120563

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.5.7 . The root cause is insufficient input validation on the currency exchange rate parameter within the save_currency() AJAX handler, which lacks proper ca...

EUVD-2026-115667

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...

EUVD-2026-115663

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...

DOGE

DOGE Darknet Osint Graph Explorer Still in dev, works right. You should use this in addtion to Darknet OSINT Transform Pay attention here Query prototype: SELECT DISTINCT customcolumnname AS input, anothercustomname AS output FROM sometable, obviously you can add other options as WHERE, ORDER BY,...

CVE-2026-95748: Hewlett Packard Enterprise (HPE) Fabric Composer: A SQL injection vulnerability exists in HPE Networking Fabric Composer

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write tho...

CVE-2026-120733: Devolutions Server: Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier…

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrato...

PT-2026-136432

An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies i...

PT-2026-136041

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 Description A privilege escalation issue exists where a self-registered user can gain unauthorized access to the System REST APIs. This occurs in deployments where WSO2 Identity Server is configure...

VulnCheck KEV: CVE-2026-55500

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export containing all credentials, API keys, OAuth tokens, and settings and full database import complete overwrite without any authentication requirement beyond the ALWAYSPROTECTED...

CVE-2026-121578: Amidaware Tactical RMM: Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various…

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

CVE-2026-119672: MongoDB Database Tools: MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when…

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119675: MongoDB Database Tools: MongoDB Database Tools mongorestore inconsistently handles the system.buckets

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized...