CVE-2026-119554

A flaw was found in Moodle's External database enrolment plugin. This vulnerability allows an authenticated attacker with course editing privileges to inject malicious SQL Structured Query Language commands through the course identification number field. During scheduled synchronization with...

CVE-2026-119427

A flaw was found in phpMyAdmin. An authenticated remote attacker can exploit a Structured Query Language SQL injection vulnerability in the Designer component by submitting crafted parameters when saving configuration settings. This issue allows the attacker to execute unintended database queries...

CVE-2026-119586

A flaw was found in the SQLite command-line interface. This vulnerability allows an attacker to achieve arbitrary command execution by convincing a user to run the recovery command on a specially crafted database. Because the recovery process fails to sanitize embedded shell instructions within t...

CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

CVE-2026-45141

Chamilo LMS, an open-source learning management system, is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 2.0.1 . The vulnerability exists because the add, delete_gradebook_from_skill, save_profile, and delete_profile actions within public/main/inc/ajax/skill.ajax.php perfor...

CVE-2026-45141 Chamilo LMS: CSRF in destructive skill-management AJAX actions

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, deletegradebookfromskill, saveprofile, and deleteprofile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::checktoken validation. An attacker can use cross-site request...

CVE-2026-119575

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2024-55978

CVE-2024-55978 Code Generator Pro = 1.2 - Unauthenticated SQL Injection Description The Code Generator Pro plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CLEANSTART-2026-ZO15380 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

CVE-2026-42501 affects multiple packages. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. See references for individual vulnerability details...

CLEANSTART-2026-UO43439 Prometheus is an open-source monitoring system and time series database

CVE-2026-44903 affects multiple packages. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-AP54978 Prometheus is an open-source monitoring system and time series database

CVE-2026-42154 affects multiple packages. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

EUVD-2026-113930

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

EUVD-2026-113929

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575

ArcadeDB versions 26.8.1 before 26.10.2 are vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows authenticated users with updateDatabaseSettings permissions to disable the LOAD CSV IP block list using the ALTER DATABASE command. By setting arcadedb.opencypher.loadCsv.blo...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

EUVD-2026-113920

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

CVE-2026-118990

CallBackery versions prior to 0.62.0 for Perl are vulnerable to a security flaw where a world-readable dump of the configuration database is left in /tmp during a configuration backup. The getConfigBlob() function uses the sqlite3 shell to write the dump to a predictable location (/tmp/cbdump) wi...

CVE-2026-118990 CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...