GRC-demo-poc-oscal

GRC-OSCAL — continuous compliance, demonstrated A working pro...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kargo, vcluster, rancher-agent, jitsucom-bulker, trivy-operator, emissary, velero, cloudnative-pg, percona-server-mongodb-operator, verticadb-operator, zarf, cilium-cli, istio, infinispan-operator, postgres-operator, trivy, dynamic-localpv-provisioner, skaffold, kots...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kargo, vcluster, rancher-agent, jitsucom-bulker, trivy-operator, emissary, velero, cloudnative-pg, percona-server-mongodb-operator, verticadb-operator, zarf, cilium-cli, istio, infinispan-operator, postgres-operator, trivy, dynamic-localpv-provisioner, skaffold, kots...

OPENSUSE-SU-2026:20586-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Changes in roundcubemail: - update to 1.6.15 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security...

QNAP TS-453E QVRPro excpostgres Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QVRPro Plugin. The issue results from an exposed dangerous method. An...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: step-ca, libnvidia-container, sbom-convert, kots, prometheus-adapter, xeol, slsa-verifier, mockery, helm-mapkubeapis, terraform-provider-azuread, gh, envoy-gateway, secrets-store-csi-driver, falco-no-driver, kubernetes-csi-driver-hostpath, go-licenses, eksctl,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: step-ca, libnvidia-container, kots, prometheus-adapter, xeol, slsa-verifier, mockery, helm-mapkubeapis, terraform-provider-azuread, gh, envoy-gateway, secrets-store-csi-driver, falco-no-driver, go-licenses, eksctl, omnibump, sftpgo-plugin-eventstore, wave,...

OPENSUSE-SU-2026:20489-1 Security update for pgvector

This update for pgvector fixes the following issue: Update to pgvector 0.8.2: - CVE-2026-3172: Buffer overflow in parallel HNSW index build bsc1258945. Changelog: Fixed Index Searches in EXPLAIN output for Postgres 18...

SUSE-SU-2026:21153-1 Security update for pgvector

This update for pgvector fixes the following issue: Update to pgvector 0.8.2: - CVE-2026-3172: Buffer overflow in parallel HNSW index build bsc1258945. Changelog: Fixed Index Searches in EXPLAIN output for Postgres 18...

SQL Injection

Overview drizzle-orm is a Drizzle ORM package for SQL databases Affected versions of this package are vulnerable to SQL Injection through the escapeName handling in the PostgreSQL, SQLite, and SingleStore dialects. An attacker can inject arbitrary SQL by supplying a malicious identifier to...

@de-otio/trellis (>=0.4.0 <=0.7.1), @fedify/amqp (>=0.1.0 <=0.2.0-dev.12) +6 more potentially affected by CVE-2026-34148 via @fedify/fedify (>=1.10.0 <=1.9.2)

@fedify/fedify NPM version =1.10.0, =0.4.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.2.0, =0.0.1, =0.1.0, =1.1.20 Source cves: CVE-2026-34148 Source advisory: SNYK:JS-FEDIFYFEDIFY-15928876...

CLEANSTART-2026-WI06218 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 1.15.1-r0

Multiple security vulnerabilities affect the postgres-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-34400

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

SQL Injection

Overview @langchain/google-cloud-sql-pg is a LangChain.js integrations for Google Cloud SQL for PostgreSQL Affected versions of this package are vulnerable to SQL Injection via the PostgresChatMessageHistory.initialize method due to the improper parameters validation before incorporating them int...

SQL Injection

Overview alerta-server is an Alerta server WSGI application Affected versions of this package are vulnerable to SQL Injection in the q parameter of the query string API due to direct interpolation of user-supplied input into SQL statements using f-strings. An attacker can execute arbitrary SQL...

GHSA-8PRR-286P-4W7J alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

CVE-2026-34400

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

CVE-2026-34400

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

CVE-2026-34400 alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...