RHEL 10 : perl-DBI (RHSA-2026:49514)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49514 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions...

AlmaLinux 10 : perl-DBI (ALSA-2026:49514)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:49514 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements with...

PT-2026-67437

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten leadin query parameter, which is concatenated without parameterized binding directly...

Oracle Linux 9 : perl-DBI (ELSA-2026-49612)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49612 advisory. - Fix unsafe string eval in DBI::Profile CVE-2026-14380 - Set a hard limit of 99999 on '?' placeholders CVE-2026-14739 Tenable has extracted the...

PT-2026-67406

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or...

PT-2026-67111

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

ROS-20260803-73-0002

The vulnerability of the RedisBloom data structure module of the Redis database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

perl-DBI security update

1.643-26.3 - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 1.643-26.2 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293...

perl-DBI security update

1.643-9.3 - Fix unsafe string eval in DBI::Profile CVE-2026-14380 - Resolves: RHEL-211149 1.643-9.2 - Set a hard limit of 99999 on '?' placeholders CVE-2026-14739 - Resolves: RHEL-193306...

PostgreSQL login bruteforce

Attempts common and wordlist-based PostgreSQL credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL login bruteforce — tests username/password combinations. """ from future import annotations import itertools import os impo...

PostgreSQL Empty Password

Tests common PostgreSQL usernames for trust or empty-password login via psycopg2. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL trust / empty-password access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-67357 ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

slater v0.24.3

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

[SECURITY] Fedora 43 Update: coturn-4.15.0-1.fc43

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

CVE-2026-68578: Missing Authentication for Critical Function

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

VulnCheck KEV: CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67341

ArcadeDB versions before 26.7.2 are affected by an authorization bypass vulnerability in SQL DEFINE FUNCTION ... LANGUAGE js. The issue allows attackers with database access to execute arbitrary JavaScript by submitting DEFINE FUNCTION statements, bypassing scripting controls intended to be admin...