CVE-2026-73608

SiYuan has a missing-authorization vulnerability in the development branch for the /api/av/getAttributeViewSearchTarget endpoint. The route is protected only by CheckAuth and performs no further authorization checks, allowing anonymous readers to query with a database identifier and a keyword to ...

CVE-2026-73608 SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

EUVD-2026-57740

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

Cypher Injection

Apache Camel Neo4J component is vulnerable to Cypher Injection. The vulnerability is due to insufficient validation of property names in the CamelNeo4jMatchProperties map, where attacker-controlled property names are concatenated directly into Cypher queries, allowing attackers to inject arbitrar...

CVE-2026-18707

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-18701

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:36+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-18695

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:21+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

PT-2026-71707

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

PT-2026-71537

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

PT-2026-71577

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

PT-2026-71533

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

PT-2026-71884

Name of the Vulnerable Software and Affected Versions FreePBX versions 16.0.0 through 16.0.10 FreePBX versions prior to 17.0.4 Description The missedcall module fails to properly escape or use bound parameters when inserting the inbound Caller ID name from SIP From headers into the missedcalllog...

CVE-2026-73670: Improper Neutralization of Special Elements used in an SQL Command

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-16961: Improper Neutralization of Special Elements used in an SQL Command

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-73608: Missing Authorization

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-72853: Improper Neutralization of Special Elements used in an SQL Command

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

CVE-2026-28189: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-14671

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL module refint allows an object creator to execute arbitrary code as the operating system user running the database. The fix for thi...

PT-2026-71822

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-71469

creationtimestamp| type| source ---|---|--- 2026-08-12 23:01:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/637i7bpnm3hto 2026-08-13 08:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msx6gxhtfw2o...