CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues

Records obtained by WIRED detail hundreds of allegations of Customs and Border Protection workers misusing internal tools to look up romantic interests and track colleagues’ cell phones...

EulerOS 2.0 SP11 : sqlite (EulerOS-SA-2026-3104)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

EUVD-2026-54566

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-71282

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

atsdk (0.2.24), auditor-apel-plugin (>=0.6.1, <=0.6.2) +64 more potentially affected by CVE-2026-69249 via cryptography (43.0.0)

cryptography PYPI version 43.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atsdk 0.2.24 - auditor-apel-plugin =0.6.1, =0.0.2, =1.1.3, =2.0.0, =0.0.21, =0.2.1, =1.0.1, =1.1.7, =1.0.0, =1.5.3, =1.5.3, =1.5.7 and...

[SECURITY] Fedora 44 Update: coturn-4.15.0-1.fc44

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

SUSE CVE-2026-11719

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol...

MailAccess v0.13.4

root@kitploit: ███╗ ███╗ █████╗ ██╗██╗ █████╗ ██████╗ ██████╗███████╗███████╗███████╗ ████╗ ████║██╔══██╗██║██║ ██╔══██╗██╔════╝██╔════╝██╔════╝██╔════╝██╔════╝ ██╔████╔██║███████║██║██║ ███████║██║ ██║ █████╗ ███████╗███████╗ ██║╚██╔╝██║██╔══██║██║██║ ██╔══██║██║ ██║ ██╔══╝ ╚════██║╚════██║ ██║...

WhoDB < 0.45.0 - Path Traversal Detection

WhoDB contains a path traversal caused by lack of validation when opening database files, letting unauthenticated attackers access arbitrary Sqlite3 databases on the host system, exploit requires attacker to manipulate database filename input. !/usr/bin/env python3 -- coding: utf-8 -- """WhoDB...

PT-2026-65307

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance SMA version 11.0.273 Description The software installs with default user credentials for the report and R1 MySQL accounts, using the publicly known password box747. This allows remote attackers to gain...

PT-2026-65308

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance SMA version 11.0.273 Description The software uses a hardcoded symmetric encryption key to encrypt secrets within the MySQL databases. Because this key is not unique to each installation, an attacker wit...

[SECURITY] Fedora 43 Update: moby-engine-29.6.2-1.fc43

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...

GHSA-JQWR-VX3P-R266 n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...

CVE-2026-63741 SurrealDB before 3.1.0 Authentication Bypass via USE statement

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue

A flaw was found in the moddavfs module of Apache HTTP Server. A WebDAV Web Distributed Authoring and Versioning content author could exploit a path handling issue to directly manipulate trusted DAV property databases. This manipulation could potentially lead to child process crashes, resulting i...

PT-2026-61557

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands. This occurs because the system fails to validate DEFINE NAMESPACE or DEFINE DATABASE permissions whe...