CVE-2026-19020

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...

WordPress User Access Manager plugin <= 2.3.12 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin User Access Manager versions = 2.3.12...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

RLSA-2026:49621 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

KLA91190 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-56162: Improper Authentication

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

PT-2026-69354

Name of the Vulnerable Software and Affected Versions Term Pages WordPress plugin versions prior to 2.0.0 Description Unauthenticated attackers can perform SQL injection attacks because the plugin fails to properly sanitize and escape a user-supplied parameter before incorporating it into a SQL...

PT-2026-68677

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection flaw exists in the /viewappointment.php file. A remote attacker can exploit this by manipulating the delid argument, allowing for unauthorized database queries...

PT-2026-68828

Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a...

CVE-2026-53984: Missing Authentication for Critical Function

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-66686: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

PT-2026-68775

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Authenticated workspace members can perform unauthorized document store operations due to missing authorization on mutation endpoints. Users with view-level permissions can send direct HTTP requests ...

PT-2026-68755

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0 Description An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's database backup event handler. Due to disabled authentication enforcement and a...

PT-2026-68587

Name of the Vulnerable Software and Affected Versions Garbage Collector Database Cleanup versions prior to 0.15 Description An unauthenticated Cross Site Request Forgery CSRF issue exists in the Garbage Collector Database Cleanup plugin. CSRF is a flaw that allows an attacker to trick a victim in...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-3001)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

vulnerable-by-design-rmf-hardening

vulnerable-by-design-rmf-hardening so i built a helpdesk tick...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic (CVE-2025-36122)

Summary IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to AUTOMATIClimit. Vulnerability Details CVEID:CVE-2025-36122 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes DB2 Connect Server...