CVE-2026-70771

creationtimestamp| type| source ---|---|--- 2026-08-19 16:45:16+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70777

creationtimestamp| type| source ---|---|--- 2026-08-19 16:45:14+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

Missing Authentication for Critical Function

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SetupController process. An attacker can perform unauthorized database migrations, create...

Missing Authentication for Critical Function

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SetupController process. An attacker can perform unauthorized database migrations, create...

CVE-2026-49392

Wazuh (free and open source threat prevention, detection, and response platform) is affected by a local SQL injection in its File Integrity Monitoring (FIM) database layer. The vulnerable functions DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored fil...

CVE-2026-49392 Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

CVE-2026-20327

Cisco Unified Intelligence Center contains a blind SQL injection vulnerability in its web-based management interface , caused by insufficient validation of user-supplied input. An authenticated attacker with valid credentials can send a crafted request to read the contents of the device's interna...

CVE-2026-20327 Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

EUVD-2026-62576

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20327 Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-75919

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...

CVE-2026-76223 ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a...

CVE-2026-76212

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-75920

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-76205

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape t...

CVE-2026-75919

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...