199 matches found
CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation
CVE-2026-22014 – GraphQL Persisted Queries Injection via ID Manipulation Program Code Node.js root@kitploit: // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ;...
Linux Distros Unpatched Vulnerability : CVE-2026-82061
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write...
UBUNTU-CVE-2026-82061
A use-after-free security issue exists in the servers query execution...
CVE-2026-82061
A use-after-free security issue exists in the servers query execution...
CVE-2026-82061
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...
EUVD-2026-72948
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...
CVE-2026-82061
CVE-2026-82061 is a use-after-free vulnerability in MongoDB Server 's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, resulting in a server process crash (denial of ser...
CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...
Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...
Linux Distros Unpatched Vulnerability : CVE-2026-18711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used...
GHSA-RGWJ-5XJ2-C3M3 vulnerabilities
Vulnerabilities for packages: sqlpad...
GHSA-MVXR-6M87-MV2Q vulnerabilities
Vulnerabilities for packages: ruby3.3-mail, pghero, logstash, kube-logging-operator...
CVE-2026-75798
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...
CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...
CVE-2026-75798
CVE-2026-75798 affects the AI Engine WordPress plugin in versions 3.4.0 through 3.7.1 . The vulnerability is a missing authorisation check in the Editor Assistant feature, which is intended to be administration-only. Instead of verifying the user's role, the plugin relies on a token it distribute...
CVE-2026-39914 TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...
BIT-KIBANA-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...
BIT-ELK-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...
CVE-2026-19631
CVE-2026-19631 describes a SQL injection vulnerability in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries and access sensitive data, including credentials. Tenable’s advisory indicates Security Center 6.9.0 fixes multiple vulnerabilities and lists ...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...