34073 matches found
EUVD-2026-38057
Statamic CMS's unsafe method invocation via collection sorting allows data destruction...
MAL-2026-6539 Malicious code in db-query-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4928f7d380b79104d997e7666603726873158508c38d2c75a90c7529dd196be3 The package presents itself as a database query helper but index.js defines a method queryDBConnect that base64-decodes a hardcoded URL pointing to...
GHSA-73CV-556C-W3G6 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Resolution Fixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...
CVE-2026-54350
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...
CVE-2026-44736
OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject title of work packages they have no permission to view — by supplying an arbitrary work package ID in the...
CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long...
CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long...
CVE-2026-56067
Unauthenticated SQL Injection in JetSmartFilters = 3.8.3 versions...
CVE-2026-56068
Unauthenticated SQL Injection in JetEngine = 3.8.10.2 versions...
EUVD-2026-39671
Sales Representative SQL Injection in Groundhogg = 4.5 versions...
CVE-2026-57667
Sales Representative SQL Injection in Groundhogg = 4.5 versions...
EUVD-2026-39668
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes = 8.2.7 versions...
CVE-2026-57653 WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability
Contributor SQL Injection in WP Job Portal = 2.5.2 versions...
EUVD-2026-39759
Contributor SQL Injection in Restaurant Menu by MotoPress = 2.4.10 versions...
CVE-2026-57644
Contributor SQL Injection in Restaurant Menu by MotoPress = 2.4.10 versions...
CVE-2026-57643 WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerability
Contributor SQL Injection in WP Post Author = 3.9.1 versions...
CVE-2026-57631
CVE-2026-57631 affects the WordPress Popup box plugin (versions
EUVD-2026-39723
Unauthenticated SQL Injection in Advance Product Search = 1.4.4 versions...