CVE-2026-73514 PostGIS address_standardizer Out-of-Bounds Write via standardize_address()

The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

SQL Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via improper validation of class definition UIDs and unquoted concatenation of class IDs in SQL queries. An attacker can access sensitive...

CVE-2026-66658

CVE-2026-66658 affects WordPress Reviewer plugin versions ≤ 3.14.2. The issue is described as a SQL Injection vulnerability (Subscriber SQL Injection) with CVSS 3.1, base score 8.5 (HIGH), vector: NETWORK/attackVector N, AC:L, PR:L, UI:N, S:C, C:H, I:N, A:L. Connected sources include CVE records ...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66430

CVE-2026-66430 describes an SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions

CVE-2026-28189

The CVE-2026-28189 entry concerns the WordPress Participants Database plugin version <= 2.7.8.4, which is affected by an unauthenticated Arbitrary File Deletion vulnerability. The available records indicate the issue arises in this plugin series and can be triggered without authentication, wit...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

EUVD-2026-57967

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

EUVD-2026-57931

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

CVE-2026-14680

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...

UBUNTU-CVE-2026-14680

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...

EUVD-2026-57834

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

CVE-2026-19004

creationtimestamp| type| source ---|---|--- 2026-08-13 12:45:03+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-2...

Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references. Original Description SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7...

GHSA-75XH-MP4F-F2RF Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references. Original Description SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7...