PT-2026-99241

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 Description An issue exists where unauthenticated users can download database backup archives. In certain scenarios, these archives are saved using a fixed filename, enabling attackers to...

CVE-2026-100687: Exposure of Sensitive Information to an Unauthorized Actor

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100631: Improper Neutralization of Special Elements in Data Query Logic

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100645: Improper Neutralization of Input During Web Page Generation

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

PT-2026-99366

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 6.0.2 Description An issue exists where the result of the CONNECTION ID database function is interpolated into JavaScript without proper escaping. This allows a malicious database server to execute arbitrary JavaScrip...

CVE-2026-100387

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into...

EUVD-2026-87324

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into...

CVE-2026-100387 pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into...

CVE-2026-100387

The pgPointcloud extension, through version 1.2.5 , contains a heap out-of-bounds read vulnerability during dimensional patch WKB deserialization . Authenticated database users can exploit this by providing crafted pcpatch values with attacker-controlled size fields. This allows the attacker to r...

CVE-2026-100387 pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into...

EUVD-2026-87289

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-97064

The X-SpringBoot framework (versions through 6.0 ) contains an authentication bypass vulnerability due to a hardcoded static master login verification code, 172839 , which is enabled by default in the database seed. Unauthenticated attackers can gain access to any user account by providing a know...

EUVD-2026-87256

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number...

CVE-2026-62262

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-42324

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

EUVD-2026-87138

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-42324 Piwigo: Second-Order SQL Injection

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-42324

The open source photo gallery application Piwigo is vulnerable to a Second-Order SQL Injection in versions prior to 16.4.0 . The root cause is that admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing a sort-field whitelist. These stored expressions a...

CVE-2026-42324 Piwigo: Second-Order SQL Injection

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

EUVD-2026-87137

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...