CVE-2026-17619: Improper Neutralization of Special Elements used in an SQL Command

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)

According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...

PT-2026-95394

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the msg id paramet...

PT-2026-95304

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...

PT-2026-95374

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An access control bypass exists in the query database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to the DatabaseContext, which...

PT-2026-95244

Name of the Vulnerable Software and Affected Versions Product Question and Answer versions prior to 1.1.1 Description The Product Question and Answer WordPress plugin fails to sanitize and escape parameters used in SQL queries during AJAX actions accessible to unauthenticated users. This allows a...

PT-2026-95242

Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated...

PT-2026-95503

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable acro...

PT-2026-95617

Name of the Vulnerable Software and Affected Versions IBM Platform RTM affected versions not specified Description An issue exists where a remote attacker can execute specially crafted SQL statements. This allows the attacker to view, add, modify, or delete information within the back-end databas...

PT-2026-95291

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.2 Description The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the...

PT-2026-95718

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The application uses a calculator-style vault passcode to protect access, but the stored data is not bound to this authentication boundary. A local actor with...

CVE-2026-87770: Improper Neutralization of Special Elements used in an SQL Command

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

PT-2026-95494

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description Account viewers can perform unauthorized actions because flow and automation write routes fail to enforce the agent role before utilizing a service-role database client that bypasses row-level security...

CVE-2026-85878: Improper Authorization

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

PT-2026-95648

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg...

PT-2026-102167

Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95599

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

PT-2026-95649

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The inherit template properties function manually surrounds primary-key column names from pg attribute.attname with double quotes without escaping embedded double-quote characters. A user with...