dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-34725 Source advisory: SNYK:JS-DBGATEWEB-15915631...

Arbitrary Code Injection

Overview dbgate-web is a This package is used internally by DbGate Affected versions of this package are vulnerable to Arbitrary Code Injection through the FontIcon rendering path in packages/web/src/icons/FontIcon.svelte. An attacker can execute arbitrary JavaScript in a victim’s browser, or...

CVE-2026-34725

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

EUVD-2026-18472

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

CVE-2026-34725

DbGate (multi-platform: web and Electron desktop) contains a stored XSS in the icon rendering path impacting versions 7.0.0–7.1.5. Attacker-controlled SVG icons stored as applicationIcon are rendered without sanitization, enabling script execution in another user’s browser (web UI) and, in Electr...

CVE-2026-34725 dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

CVE-2026-34725 dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

CVE-2026-34725: Improper Control of Generation of Code

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in t...

DbGate 代码注入漏洞

DbGate is an open-source database manager developed by DbGate. Versions of DbGate from 7.0.0 to 7.1.5 had a code injection vulnerability. This vulnerability occurred because SVG icon strings controlled by attackers were rendered as raw HTML without being cleaned properly, which could lead to...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-34725 Source advisory: OSV:GHSA-35XM-QVJG-8M42...

GHSA-8GC5-J5RX-235R vulnerabilities

Vulnerabilities for packages: dbgate, renovate, jitsucom-jitsu, kubeflow-pipelines, langfuse, tileserver-gl-fips, prism, librechat, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

CVE-2026-33036 vulnerabilities

Vulnerabilities for packages: dbgate, renovate, jitsucom-jitsu, kubeflow-pipelines, langfuse, tileserver-gl-fips, prism, librechat, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

GHSA-M7JM-9GC2-MPF2 vulnerabilities

Vulnerabilities for packages: dbgate, renovate, langfuse, tileserver-gl-fips, prism, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

CVE-2026-25896 vulnerabilities

Vulnerabilities for packages: dbgate, renovate, langfuse, tileserver-gl-fips, prism, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

GHSA-37QJ-FRW5-HHJH vulnerabilities

Vulnerabilities for packages: dbgate, renovate, jitsucom-jitsu, kubeflow-pipelines, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, prism, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

CVE-2026-25128 vulnerabilities

Vulnerabilities for packages: dbgate, renovate, jitsucom-jitsu, kubeflow-pipelines, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, prism, langfuse-fips, saf, tileserver-gl, kibana, dbgate-fips...

EUVD-2025-22773

Malicious code in bioql PyPI...

EUVD-2025-22767

Malicious code in bioql PyPI...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...