trivy-java-db

trivy-java-db Panoramica trivy-java-db crea un database SQLite dai dati del repository maven-index, memorizzando ArtifactID, GroupID, Version e sha1 per i file jar. Il DB viene utilizzato in Trivy per individuare informazioni sui jar senza GAV al loro interno. Intervallo di aggiornamento Ogni...

CLEANSTART-2026-JM42748 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...

CVE-2026-108648: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-108591: External Control of File Name or Path

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

Linux Distros Unpatched Vulnerability : CVE-2026-106434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An...

Linux Distros Unpatched Vulnerability : CVE-2026-107819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C...

PT-2026-109909

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SystemApiController within the GET '/sys/api/getDynamicDbSourceByCode' endpoint. The endpoint lacks Shiro permission or role annotations, allowing an authenticat...

CVE-2026-104023: Improper Neutralization of Special Elements used in an SQL Command

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

GHSA-5974-GFQC-WRCM Contao: Improper access control in the table access voter

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container DCA backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This include...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

GHSA-R6W9-259G-GWRV Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over...

DEBIAN-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

UBUNTU-CVE-2026-107819

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

CVE-2026-107822 MariaDB: database privilege escalation via user / role name collision in the acl cache

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

WordPress Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin <= 3.4.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Extensions For CF7 versions = 3.4.5...

CVE-2026-107814

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...