CVE-2026-23921

CVE-2026-23921 — Zabbix Time-Based Blind SQL Injection Affected versions: Zabbix 50 THEN pgsleep3 ELSE pgsleep0 END-- Usage PostgreSQL backend d...

CVE-2026-92771

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771

Twenty (by twentyhq) before 2.35.0 contains a permission bypass in the groupBy-with-records GraphQL resolver within the twenty-server engine. The resolver fails to validate field and row permissions, allowing authenticated users who hold canReadObjectRecords but have canReadFieldValue set to fals...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

EUVD-2026-81035

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771: Incorrect Authorization

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

PT-2026-94049

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.35.0 Description Authenticated users can bypass permission checks due to a failure to validate field and row permissions in the groupBy-with-records GraphQL resolver. An attacker possessing the canReadObjectRecords...

CVE-2026-55416: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...

CVE-2026-81527

CVE-2026-81527 is a NoSQL/expression injection flaw in the MongoDB C# Driver , specifically in the LINQ-to-aggregation query translation layer affecting both aggregation expression and query filter translation. The root cause is that unquoted constant GroupBy keys in LINQ pipeline translation are...

CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...

CVE-2026-47378

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on...

CVE-2026-47384

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific...

CVE-2026-47384

CVE-2026-47384 – NocoDB SQL Injection via Column Title in Bulk GroupBy : An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column title to a SQL fragment. The vulnerable code path builds three database-specific knex.raw() aggregations t...

CVE-2026-47384 NocoDB: SQL Injection via Column Title in Bulk GroupBy

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific...

CVE-2026-47384 NocoDB: SQL Injection via Column Title in Bulk GroupBy

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific...

CVE-2026-47378: Authorization Bypass Through User-Controlled Key

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on...

CVE-2026-47384: Improper Neutralization of Special Elements used in an SQL Command

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific...