@paperclipai/server (>=2026.3.17-canary.2, <=2026.415.0-canary.7), companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) +4 more potentially affected by unknown CVE via @paperclipai/db (>=2026.3.17-canary.2, <=2026.415.0-canary.7)

@paperclipai/db NPM version =2026.3.17-canary.2, =2026.3.17-canary.2, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAIDB-16421488...

@paperclipai/server (>=2026.3.17-canary.2, <=2026.415.0-canary.7), companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) +4 more potentially affected by unknown CVE via @paperclipai/db (>=2026.3.17-canary.2, <=2026.415.0-canary.7)

@paperclipai/db NPM version =2026.3.17-canary.2, =2026.3.17-canary.2, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAIDB-16421449...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, envoy-ratelimit, victoriametrics-cluster, flux-source-controller, datadog-agent, terraform-provider-azapi, lvm-driver, mariadb-operator, redpanda, lazygit, spire-controller-manager, cloud-provider-aws, scorecard, rook, hubble, grpcurl...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: trivy-operator, zot, xeol, grype-fips, trivy-fips, kots, packer, tflint, cloudbeat-fips, conftest, cloudbeat, tflint-fips, zarf, crossplane-provider-terraform-fips, chainctl, kubescape, conftest-fips, tfsec, terraform-fips, kubescape-server-fips, opentofu, k9s-fips,...

Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users

Summary Users with the Guest role could receive private sub-object data e.g. private alternate names, private addresses, private note/citation/media handles through list API endpoints such as GET /api/people/, GET /api/places/, GET /api/events/, and all other object list endpoints. This does not...

CVE-2026-5847: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file /db/moviedb.sql of the component SQL Database Backup File Handler. Such manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been...

CVE-2026-5960: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The...

CVE-2026-0814

The CVE-2026-0814 entry concerns the WordPress plugin Advanced CF7 DB . A missing capability check in the function vsz_cf7_export_to_excel affects all versions up to and including 2.0.9 , enabling authenticated users with Subscriber-level access and above to export form submissions to Excel files...

CVE-2026-39393 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block...

CVE-2026-0811: Cross-Site Request Forgery (CSRF)

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the 'vszcf7savesettingcallback' function. This makes it possible for unauthenticated attackers to...

CVE-2026-0814: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vszcf7exporttoexcel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access an...

Linux Distros Unpatched Vulnerability : CVE-2026-35549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the cachingsha2password authentication...

MariaDB Server 安全漏洞

MariaDB Server is an open-source relational database system developed by MariaDB. Vulnerabilities existed in versions prior to 11.4.10, as well as in versions 11.5.x to 11.8.x, up to 11.8.6, and 12.x up to 12.2.2. These vulnerabilities were due to a buffer overflow in the cachingsha2password...

(Pwn2Own) QNAP QHora-322 qvpn_db_mgr role_type Improper Neutralization of Escape Sequences Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected QNAP QHora-322 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the roletype parameter...

@n8n/backend-test-utils (1.11.0), @n8n/db (1.11.0) +1 more potentially affected by unknown CVE via n8n-core (2.11.0)

n8n-core NPM version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 1.11.0 - @n8n/db 1.11.0 - @n8n/task-runner 2.11.0 Source cves: unknown CVE Source advisory: SNYK:JS-N8NCORE-15825749...

@n8n/backend-test-utils (>=1.10.0, <=1.10.1), @n8n/db (>=1.10.0, <=1.10.2) +2 more potentially affected by unknown CVE via n8n-core (>=2.10.0, <=2.10.1)

n8n-core NPM version =2.10.0, =1.10.0, =1.10.0, =2.10.0, =2.10.1 - n8n-runner 0.0.4 Source cves: unknown CVE Source advisory: SNYK:JS-N8NCORE-15825749...

CVE-2026-4506

A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function askdb of the file mindsql/core/mindsqlcore.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was...

CVE-2026-4530

A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminologyretriever.py. Performing a manipulation of the argument Description results in sql injection. The attack requires a local approach. The exploit has been...

CVE-2026-4505

A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function moduleplugin.refreshplugins of the file packages/dbgpt-serve/src/dbgptserve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload. It is possible ...

CVE-2026-4504

A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Th...