PYSEC-2026-2580 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...

The vulnerability of Microsoft Bing’s search system, related to insufficient validation of queries on the server side, allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of Microsoft Bing’s search system is related to insufficient validation of queries on the server side. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility of protected information...

CVE-2024-4872

A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker must have a valid credential...