CVE-2026-15918

The CVE describes a SQL injection in the VikAppointments WordPress plugin (versions

Linux Distros Unpatched Vulnerability : CVE-2026-71235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua scri...

CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

PT-2026-67706

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/catalogue stats.pl script builds dynamic SQL within the calculate function by interpolating user-controlled Line and Column request parameters directly into identifier positions of t...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67341 ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67341

ArcadeDB versions before 26.7.2 are affected by an authorization bypass vulnerability in SQL DEFINE FUNCTION ... LANGUAGE js. The issue allows attackers with database access to execute arbitrary JavaScript by submitting DEFINE FUNCTION statements, bypassing scripting controls intended to be admin...

SUSE CVE-2026-4370

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client...

CVE-2026-63231

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63231 Post-authentication SQL injection vulnerability

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63231

Koollab LMS contains a post-authentication SQL injection in the face-to-face runs update endpoint. An authenticated attacker can trigger an error-based SQL condition to read the application database and obtain valid JWT tokens, enabling account takeover. The vulnerability is described across mult...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-63359

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

RISK EVALUATION A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the filter...

[SECURITY] Fedora 44 Update: perl-DBI-1.651-1.fc44

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

PT-2026-70177

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 Description The PostgresTrigger node fails to properly escape user-supplied identifier parameters when interpolating them into SQL statements. This allows...

CVE-2026-55084 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-11876 Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the time-series, batch, Prometheus, and Grafana HTTP handlers in AbstractServerHttpHandler-based routes such as PostBatchHandler, PostTimeSeriesWriteHandler, PostTimeSeriesQueryHandler,...