CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CLEANSTART-2024-EW22623 lock was missing when accessing a data structure and importing certificate information into the trust database

Security vulnerability affects the firefox package. A lock was missing when accessing a data structure and importing certificate information into the trust database...

CVE-2026-67401

CVE-2026-67401 SQL injection in cPanel EmailTrack. Authenticated cPanel user with mail privileges writes arbitrary files as root via SQLite ATTACH DATABASE. One request to root. Haven't tested on a real target, code is only put together from public information and basic diff'ing. Do your due...

CVE-2026-115820

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns array keys' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-8574

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...

web2py-e94946d-CVE-2016-3957

Readme web2py is a free open source full-stack framework for rapid development of fast, scalable, secure and portable database-driven web-based applications. It is written and programmable in Python. LGPLv3 License Learn more at http://web2py.com Google App Engine deployment cp examples/app.yaml ...

CLEANSTART-2026-PN69932 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

CVE-2026-42501 affects multiple packages. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. See references for individual vulnerability details...

EUVD-2025-211228

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...

CVE-2025-8574 Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...

CVE-2025-8574

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to and including 1.4.7 . The root cause is a lack of restriction on which database tables can be deleted. This allows authenticated attackers with Administrator-level access and above to delete ...

CVE-2022-24716

CVE-2022-24716 Icinga Web 2 is a software application that monitors computer systems and networks. It has a web interface that allows users to view and manage system resources. However, there is a vulnerability in Icinga Web 2 that allows unauthenticated users to access files on the system that a...

CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

CVE-2021-2173

CVE-2021-2173 CVE-2021-2173 PoC is explained here: https://databasesecurityninja.wordpress.com/2021/06/04/cve-2021-2173-pdb-isolation-is-broken-through-metadata-exposure/ Oracle Critical Patch Update Advisory - April 2021: https://www.oracle.com/security-alerts/cpuapr2021.html...

CVE-2023-23752

CVE-2023-23752 This is a proof-of-concept code for the CVE-2023-23752 vulnerability. It allows an attacker to extract sensitive information such as usernames, passwords, and database names from a target application. Bulk scanner + get config + ip target from CVE-2023-23752 Screenshot Installation...

EUVD-2026-114104

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

CVE-2026-119554

A flaw was found in Moodle's External database enrolment plugin. This vulnerability allows an authenticated attacker with course editing privileges to inject malicious SQL Structured Query Language commands through the course identification number field. During scheduled synchronization with...

CVE-2026-119427

A flaw was found in phpMyAdmin. An authenticated remote attacker can exploit a Structured Query Language SQL injection vulnerability in the Designer component by submitting crafted parameters when saving configuration settings. This issue allows the attacker to execute unintended database queries...