96799 matches found
CVE-2026-119575: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated…
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...
CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...
CVE-2026-63224: openremote: OpenRemote is an open-source internet-of-things platform
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the datapoint export API constructs CSV crosstab SQL by concatenating an asset name and attribute name into a COPY query that uses crosstab and streams TO STDOUT. The asset name enters both a double-quoted column identifie...
CVE-2026-119561: phpMyAdmin: phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in…
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...
CVE-2026-118990: Improper Link Resolution Before File Access
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...
CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
PT-2026-133776
Name of the Vulnerable Software and Affected Versions Transliterator versions 2.5.13 and earlier Description An unauthenticated attacker can perform a SQL Injection, which allows the execution of arbitrary SQL queries to read or modify the site database. This issue occurs within a CMS plugin...
PT-2026-133531
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...
PT-2026-133499
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn request response wit...
CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-119562: phpMyAdmin: phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by…
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...
PT-2026-133500
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col extra and col attribute values to /database/central-columns. Attackers can inject SQL into pma central columns INSERT and UPDATE queries run with controluser...
PT-2026-133687
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and...
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values directly to...
PT-2026-134235
Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.26.0 Description The datapoint export API constructs SQL for CSV crosstab by concatenating an asset name and attribute name into a COPY query. Because escaping single quotes does not protect double-quoted...
Linux Distros Unpatched Vulnerability : CVE-2026-119210
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the...
CentOS Linux 6 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-cron / rpm-devel / rpm-libs / etc (CENTOS6:CLSA-2026:1793110602)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793110602 advisory. - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...
CVE-2026-11587
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...
CVE-2026-107056
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...