CVE-2025-1094-PoC-Postgre-SQLi

Analysis of CVE-2025-1094 and Emulation Setup This detailed examination, conducted on March 14, 2025, explores CVE-2025-1094, a hypothetical high-severity SQL injection vulnerability in PostgreSQL, based on the provided emulation setup and proof-of-concept PoC execution. The analysis covers the...

PT-2026-90389

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd4 ff encode getdeviceinfo function where the da addr body reservation is incorrectly calculated. The function computes the reservation as 16 + netid len + addr len...

ROS-20260907-73-0501

The vulnerability of the mbregexuringencoding function in the PHP interpreter is related to discrepancies in the lists of encodings between the Oniguruma library and mbfl, as a result of a pointer assignment error. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-55858

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

GHSA-5RQC-86VF-G8R2 org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

GHSA-XVR9-35CR-46V9 org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

CVE-2026-55858

MariaDB Connector/J (org.mariadb.jdbc:mariadb-java-client) is vulnerable to a charset-confusion mismatch in versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The connector assumes a UTF-8 connection character set for protocol encoding/decoding and client-side escaping. If the server reports a mi...

waf-requests

wafrequests Educational drop-in replacement for requests d...

K000162837: PHP vulnerability CVE-2026-7259

Security Advisory Description In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability ...

ALPINE-CVE-2025-58146

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but...

CVE-2025-58146

CVE-2025-58146 affects Xen/XAPI: three issues in UTF-8 handling and input sanitisation of XAPI database. (1) Unsanitised input used for notifications can terminate the database event thread and stop processing. (2) UTF-8 encoder aligns with Unicode v3.0 while libraries use v3.1, allowing strings ...

php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

PHP mbregexuringencoding() DoS

The vulnerability of the mbregexuringencoding function in the PHP interpreter is related to discrepancies in the lists of encodings between the Oniguruma library and mbfl, as a result of a pointer assignment error. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-7259

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-021467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021467 advisory. In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads toa...

Linux Distros Unpatched Vulnerability : CVE-2026-44309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-enco...

OESA-2026-2341 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-2340 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...