CVE-2026-109954

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

CVE-2026-109954

Parse Server versions 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 are vulnerable to a race condition (CWE-362) where transactional batch state is shared across concurrent requests. This allows a client's transactional batch request to interfere with other clients' database writes. On Post...

CVE-2026-89199

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal...

CVE-2026-89201

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...

CVE-2026-89203

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker ...

CVE-2026-89196

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...

CVE-2026-59241

A vulnerability has been identified in SIMATIC WinCC V7.5 All versions, SIMATIC WinCC V8.0 All versions V8.0 Update 11, SIMATIC WinCC V8.1 All versions V8.1 Update 7. The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an...

CVE-2026-89204

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized...

CVE-2026-89203

A vulnerability exists in RUGGEDCOM CROSSBOW (all versions

CVE-2026-89201

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...

CVE-2026-89199

The RUGGEDCOM CROSSBOW (all versions

CVE-2026-59241

A vulnerability exists in SIMATIC WinCC versions V7.5 (all), V8.0 (all versions < V8.0 Update 11), and V8.1 (all versions

CVE-2026-59241

A vulnerability has been identified in SIMATIC WinCC V7.5 All versions, SIMATIC WinCC V8.0 All versions V8.0 Update 11, SIMATIC WinCC V8.1 All versions V8.1 Update 7. The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an...

libreoffice: libreoffice: Arbitrary code execution via remote Java database driver

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

Important: Red Hat Security Advisory: libreoffice security update

An update for libreoffice is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Configuration Information Scanner This tool is used to scan Pterodactyl panel instances in an attempt to retrieve their database configuration information. By exploiting a specific path traversal vulnerability, sensitive configuration data of the panel can be...

CVE-2026-89113

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

EUVD-2026-98065

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

EUVD-2026-98043

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

EUVD-2026-98038

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...