CVE-2025-59470-PostgreSQL-Command-Injection

受影响软件：PostgreSQL 15.x 早于 15.7 的版本，16.x 早于 16.3 的版本。 漏洞类型：pgbackup 扩展中的命令注入。 描述：pgbackup 扩展未能正确清理用户提供的参数，使得备份操作员能够注入任意命令，这些命令将以 PostgreSQL 用户身份执行。...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

CVE-2026-53602

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-63464

CVE-2026-63464 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2 . The vulnerability is an SSRF that arises because non-admin operators (role user) can set allow_private: true on their own webhook subscription via POST/PATCH /api/v...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19283

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

CVE-2026-19283 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-85625

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625

sift (sift.js) 17.1.3 is vulnerable to remote code execution due to its use of for...in to enumerate query keys, which walks the object prototype chain and dispatches any matched operator key including $where . The $where operator compiles a string value into a function via new Function unless CS...

EUVD-2026-71232

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

PT-2026-85549

Name of the Vulnerable Software and Affected Versions sift sift.js versions prior to 17.1.4 Description The software enumerates query keys using a for...in loop, which traverses the object prototype chain and dispatches matched operator keys, including $where. The $where operation compiles a stri...

UBUNTU-CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

The vulnerability of the tegra124_emc_prepare_timing_change() function in the drivers/memory/tegra/tegra124-emc.c module of the NVIDIA Tegra system-on-chip driver software, which affects the Linux operating system kernel, allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the tegra124emcpreparetimingchange function in the drivers/memory/tegra/tegra124-emc.c module of the NVIDIA Tegra system controller driver is related to the use of an erroneous operator. Exploiting this vulnerability could allow a remote attacker to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-76175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator...

UBUNTU-CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-85441 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process...