PT-2026-57140

Name of the Vulnerable Software and Affected Versions JoomSport versions prior to 5.8.0 Description The JoomSport plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the software fails to properly escape user-supplied parameters and lacks sufficient preparation of t...

PT-2026-56657

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file incclassesView.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the publ...

CVE-2026-59827: Deserialization of Untrusted Data

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns ...

PT-2026-56843

Name of the Vulnerable Software and Affected Versions note-mark affected versions not specified Description An unauthenticated user can access metadata of soft-deleted notes belonging to public books. This occurs because the endpoint '/api/books/bookID/notes' allows the use of a deleted query...

PT-2026-56887

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description In the backend/open webui/routers/terminals.py file, the ws terminal upstream URL is constructed using an unencoded session id and appends user id as a query parameter. This allows for query...

PT-2026-57026

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description A stored SQL injection exists in the recentchanges action via the actions/recentchanges.php endpoint. The system accepts a period argument from two different parameter sources. While the URL form is...

PT-2026-57031

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.2.0 through 4.6.5 Description YesWiki contains a second-order SQL injection issue where data is safely stored in the database but later used in a query without proper escaping. A low-privilege authenticated user can create a...

CVE-2026-4256: Improper Neutralization of Special Elements used in an LDAP Query

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026...

CVE-2026-59224: Improper Authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

ROS-20260709-73-0001

The vulnerability of the refint module in the PostgreSQL database management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-55590: URL Redirection to Untrusted Site

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the...

dnsmasq < 2.93 Heap-Based Buffer Overflow (CVE-2026-12725)

The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a heap-based buffer overflow vulnerability. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause...

Progress MOVEit Transfer < 2025.0.8 / 2025.1.0 < 2025.1.4 / 2026.0.0 < 2026.0.1 Multiple Vulnerabilities

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.0.8, 2025.1.x prior to 2025.1.4, or 2026.0.x prior to 2026.0.1. It is, therefore, affected by multiple vulnerabilities: - Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress...

CVE-2026-15134 CodeAstro Simple Online Leave Management System index.php sql injection

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from...

Cross-site Scripting (XSS)

Overview @appium/base-driver is a Base driver class for Appium drivers Affected versions of this package are vulnerable to Cross-site Scripting XSS via compileLodashTemplate. An attacker can execute arbitrary JavaScript in the context of the server origin by injecting malicious input into the...

CVE-2026-57481

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber'...

PYSEC-2026-3446

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied...

CVE-2026-35211

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied...

CVE-2026-35211

OpenCTI exposes a script filter operator in the GraphQL FilterOperator enum prior to version 7.260401.0. An authenticated user with the KNOWLEDGE capability can pass user-supplied Elasticsearch Painless script values directly into search queries without validation, enabling potentially expensive ...

CVE-2026-57480

Parse Server is affected by a denial-of-service issue where deeply nested $or, $and, and $nor query operators in REST API or LiveQuery handling can cause exponential-time processing that blocks the Node.js event loop. The vulnerability affects prior releases and is fixed in versions 9.9.1-alpha.1...