CVE-2026-60722

...

EUVD-2026-61490

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...

CVE-2026-53759 linuxfabrik-lib: Insecure creation of SQLite databases

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...

CVE-2026-53759

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the paneladmins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...

SQL Injection

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to SQL Injection in the ipaddress parameter of the Admins.add or Admins.update process. An attacker can extract sensitive database information, including administrator login names and...

GHSA-W27M-RMMF-G5W4 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the paneladmins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...

GHSA-M5PQ-69XG-VCQ3 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-54348

Froxlor (open-source server administration panel) prior to 2.3.8 is affected by a second-order SQL injection in its admin API. The Admins.add/Admins.update endpoints store an attacker-controlled ipaddress array as JSON in panel_admins.ip without numeric type enforcement. When the poisoned account...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

EUVD-2026-61150

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-52723

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestjgtg72p 2026-08-18 19:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6fc7cl2j...

SUSE-SU-2026:23192-1 Security update for rpm

This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...

com.github.vzakharchenko:radius-disconnect-plugin (1.6.1), com.github.vzakharchenko:radius-plugin (1.6.1) +65 more potentially affected by CVE-2026-18963 via org.keycloak:keycloak-services (>=26.4.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.4.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.9, =0.119, =2.1.10, =8.10, =8.10, =8.12 and more Source cves: CVE-2026-18963 Source advisory: MEND:CVE-2026-18963...

WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability

Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...