CVE-2026-119673: MongoDB Database Tools: MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for…

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

PT-2026-136445

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrato...

CVE-2026-45146: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

PT-2026-136272

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

CVE-2026-120067

A flaw was found in postgresql-odbc. When processing updatable database queries, the driver copies internal row metadata into a fixed-size memory buffer without verifying the data length sent by the server. A malicious database server or an untrusted user capable of creating custom database views...

CVE-2026-77881

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

EUVD-2026-115248

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-120487

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-120444

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120487 LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-120487

LaraDashboard versions prior to 1.4.5 are affected by an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows non-Superadmin administrators who possess settings.edit permissions to perform restricted Superadmin-only core-upgrade operations. E...

CVE-2026-120487 LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

EUVD-2026-115222

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

EUVD-2026-115204

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120444 GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120444 GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120444 GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120444

The GoFound software (through version 1.4.1 ) is vulnerable to a path traversal vulnerability. An unauthenticated attacker can delete arbitrary directories by supplying ../ sequences in the database parameter of the GET requests sent to /api/db/create and /api/db/drop . This flaw triggers the os....

CVE-2026-2613

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...