GO-2026-4602 vulnerabilities

Vulnerabilities for packages: deck, tetragon, azcopy, pulumi-language-yaml, argo-workflows-fips, terraform-provider-databricks-fips, go-discover-fips, kubo-fips, openbao-k8s, goose, rook, sonobuoy-fips, hubble-fips, sonobuoy, sftpgo-plugin-geoipfilter, timestamp-authority-fips, yunikorn-web,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: aactl, fulcio, cosign-fips, timestamp-authority-fips, spire-server, oauth2-proxy, bank-vaults-fips, flux-source-controller, tkn, spire-server-fips, slsa-verifier, kots, flux-kustomize-controller, vexctl, cloudflared, fulcio-fips, dex, falcoctl-fips, cosign,...

GO-2022-0452 vulnerabilities

Vulnerabilities for packages: ctop, podman...

GO-2025-4240 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, kots, docker-machine-driver-harvester, rancher-system-agent, mesosphere-vsphere-csi, yunikorn-k8shim, rancher-agent, kubernetes-csi-driver-nfs, calico, aws-efs-csi-driver, rancher, vcluster, nodetaint, argo-cd, kubernetes-csi-driver-hostpat...

GO-2026-4868 vulnerabilities

Vulnerabilities for packages: prometheus-operator, go, container-object-storage-interface, tigera-operator, falco-no-driver, gitlab-pages, http-echo, aws-application-networking-k8s, buf, docker-cli, gofumpt, regclient, kubernetes-csi-external-attacher, kubeflow-katib,...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: petname, dex, pulumi-kubernetes-operator, cortex, stakater-reloader, cfssl, k8ssandra-operator, kubernetes-dns-node-cache, gosu, haproxy-ingress, secrets-store-csi-driver-provider-azure, runc, speedtest-go, tailscale, nuclei, fq, php-fpmexporter, helm-push,...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-58590

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

SAP NetWeaver AS ABAP Privilege Escalation (3772411)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a privilege escalation vulnerability as referenced in SAP Security Note 3772411: - SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low...

CVE-2026-73663

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408

Budibase (open-source low-code platform) is affected up to version 3.39.18 in the MySQL integration code path, specifically packages/server/src/integrations/mysql.ts where multipleStatements is enabled and an unescaped tableName is inserted into a DESCRIBE statement. An attacker able to create a ...

EUVD-2026-58486

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-16961

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-16961

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...