CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

EUVD-2026-77459

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

CVE-2026-77051

Apache Syncope is vulnerable to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized entityKey and opEvent parameters. This issue ...

Astra Linux – Vulnerability in Mariadb 10.3

A issue in the Createtmptable::finalize component of MariaDB Server v10.7 and below was discovered. This issue allows attackers to cause a Denial of Service DoS attack through specially crafted SQL statements...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the Neo4j persistence layer when processing FIQL search conditions. An attacker can execute arbitrary Cypher queries by crafting malicious FIQL search inputs. Remediation Upgrade...

Astra Linux – Vulnerability in bind9

The DNS message parsing code in named includes a section whose computational complexity is excessively high. This does not cause problems for typical DNS traffic, but crafted queries and responses may lead to excessive CPU load on the affected named instance by exploiting this flaw. This issue...

CVE-2026-82232

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232

Apache Syncope is vulnerable to an SQL injection flaw caused by the improper neutralization of special elements in SQL commands. Specifically, an administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort clauses during a Task search . Th...

EUVD-2026-77378

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

Microsoft Discovery Studio Disclosure Information

The vulnerability of the Microsoft Discovery Studio research environment is related to the improper elimination of special elements in data queries. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

PT-2026-91196

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

CVE-2026-77051: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

PT-2026-91149

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-80491 SAMO Forms <= 1.0.0 - Unauthenticated SQLi

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-73698

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-73698 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...