CVE-2026-61483 Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS

UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to...

CVE-2026-11421

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15918

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

CVE-2026-18852

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual condition...

CVE-2026-18854

The CVE-2026-18854 affects Shandong Hoteam PDM Product Data Management System up to version 8.3.10. The vulnerability is in the GetStoredClassByFilter function of /Base/BaseService.asmx/DataService, where manipulating the FilterString argument enables SQL injection. Remote exploitation is possibl...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2026-69704 Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-24076

Memory Corruption when processing registry values with incorrect types using a direct query method...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

EUVD-2026-52757

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

EUVD-2026-52747

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-24076

Technical details for CVE-2026-24076 are not publicly available in the provided documents. No affected products, components, versions, vectors, or fixes are disclosed. Monitor for updates from the sources in the initial entry.

CVE-2026-24076 Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory Corruption when processing registry values with incorrect types using a direct query method...

EUVD-2026-52729

Memory Corruption when processing registry values with incorrect types using a direct query method...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

CVE-2026-18801

OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....