EUVD-2026-66341

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...

EUVD-2026-66282

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

PT-2026-82253

Name of the Vulnerable Software and Affected Versions MCMS versions prior to 6.2.1 Description The front-end interface '/cms/category/list' is susceptible to SQL injection. The size parameter is directly concatenated into the LIMIT clause of a SQL query via FreeMarker $size without proper...

CVE-2026-75334: Improper Neutralization of Special Elements used in an SQL Command

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

CVE-2026-9668: Improper Neutralization of Special Elements used in an SQL Command

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...

CVE-2026-68000

The front-end interface /cms/category/list of MCMS versions

EUVD-2026-66702

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-75798: Missing Authorization

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

PT-2026-81984

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...

CVE-2026-68000

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-68000

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution . The vulnerability exists because the sqlResource.sql parameter, submitted via the ReportController.save() interface, is stored in the t_report_sql_resource table and subsequently embedded directly int...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-56706: Use of Insufficiently Random Values

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-21729

A flaw was found in Loki. A remote attacker can exploit this vulnerability by sending specially crafted queries with large limits, leading to excessive memory allocation. This can cause a Denial of Service DoS by impacting the availability of the Loki service. Mitigation To mitigate this issue,...

[SECURITY] [DSA 6459-1] libnet-dns-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6459-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 22, 2026 https://www.debian.org/security/faq -...

Debian dsa-6459 : libnet-dns-perl - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6459 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6459-1 [email protected] https://www.debian.org/securit...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2024-40094)

Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service attack. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENF...