CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834: Heap-based Buffer Overflow

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-28191

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...

CVE-2026-28191

A privilege escalation vulnerability affects the WordPress plugin The Grid (versions

CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28191: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...

PT-2026-77032

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Phat RiO in WordPress Plugin The Grid versions = 2.7.9.1...

CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741

Summary of CVE-2026-44741 / GHSA-h4ph-crvj-9h92: The Pimcore Admin Classic Bundle contains a SQL injection in the translation grid date filter where the user-supplied property field is interpolated into a SQL expression (UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))) without parameterization. Affected...

EUVD-2026-57357

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741: Improper Neutralization of Special Elements used in an SQL Command

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the id column filter in the DataObject grid. An attacker can execute arbitrary SQL commands by submitting crafted input, potentially exfiltrating or modifying all database contents. This is only exploitable if the...

CVE-2026-72562

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...

CVE-2026-72562

CVE-2026-72562 affects Pimcore’s admin-ui-classic-bundle (through version 2.3). Affected: DataObject grid id column filter allows an SQL injection because the filter value is concatenated into the SQL WHERE clause without parameterization. Root cause: improper handling of filter input in backend ...