@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +6 more potentially affected by CVE-2026-73651 via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =0.2.0, =1.1.43, =1.1.45 Source cves: CVE-2026-73651 Source advisory:...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +6 more potentially affected by unknown CVE via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =0.2.0, =1.1.43, =1.1.45 Source cves: unknown CVE Source advisory:...

CVE-2026-61256

...

CVE-2026-61247

CVE-2026-61247 affects Oracle E-Business Suite Oracle Workflow, specifically the Workflow Notification Mailer. Affected versions are 12.2.3 through 12.2.15. The vulnerability can be triggered by an unauthenticated attacker who can access via SMTP over the network, enabling unauthorized update/ins...

CVE-2026-61226

Summary of CVE-2026-61226 (Oracle) : A vulnerability in Oracle Communications Converged Application Server, component RTP Proxy, affects version 8.3. The issue allows a high-privileged attacker who can log into the infrastructure running the server to compromise the application server, with poten...

CVE-2026-60674

...

CVE-2026-60658

...

CVE-2026-60645

...

CVE-2026-60616

...

CVE-2026-60491

CVE-2026-60491 affects Oracle E-Business Suite, Oracle Advanced Inbound Telephony (SDK client integration) for versions 12.2.3–12.2.15. The vulnerability can be exploited remotely over HTTP by a low-privileged user, potentially leading to unauthorized update/insert/delete of Oracle Advanced Inbou...

EUVD-2026-46358

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-21954

CVE-2026-21954 affects Oracle Retail Xstore Point of Service (Xstore Mobile), affected in version 21.0.3. A low-privileged, network-access attacker (via HTTP) can cause unauthorized read access to a subset of Xstore POS data. CVSSv3.1 base score 4.3 (Confidentiality). The Oracle July 2026 Critica...

CVE-2026-16484 SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file...

CVE-2026-63080 Aptabase SQL Injection via ClickHouse query backend

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

GHSA-V96J-25GV-G2W9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...

CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-55084

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-55082

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...