CVE-2026-76426: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-92591: Not Failing Securely

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-86462: Insufficient Session Expiration

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

PT-2026-94079

Name of the Vulnerable Software and Affected Versions UVdesk Community Skeleton versions prior to 1.1.9 Description The software fails to authenticate or validate the installation state on wizard endpoints within the ConfigureHelpdesk controller actions. This allows unauthenticated attackers to...

Java VM Oracle Database Server Compromise

The vulnerability of the Java VM component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the system using network protocols...

Oracle Database Server Unauthorized Access

The vulnerability of the RDBMS component of the database management system, Oracle Database Server, is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-94027

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the...

CVE-2026-16588: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-92782: Incorrect Authorization

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...

CVE-2026-84859: Improper Neutralization of Special Elements used in an SQL Command

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

PT-2026-94133

New CVE published: CVE-2026-71548 Sometimes you don't need to break the syntax, just go with it 🎯 Authenticated SQL injection in SuiteCRM's AOR Reports module High, CVSS 8.8. Any low-privileged user who can save a report could read the whole database, including the admin password hash. Fixed in...

CVE-2026-82311: Insufficient Session Expiration

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-20242: Deserialization of Untrusted Data

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

PT-2026-93964

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks on an affected device due to improper validation of user-supplied input. By sending a crafted request, an attacker could...

PT-2026-93963

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center FMC Software affected versions not specified Description A flaw in the External Database Access feature allows an unauthenticated remote attacker to execute arbitrary commands with root privileges. The...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-20300: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

CVE-2026-20247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...

PT-2026-93402

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cooki...