CVE-2026-15721

The CVE concerns Bilin Software’s HUMANIST Digital Human Resources. A SQL Injection vulnerability exists in versions before 26.1 (26.0 prior to 26.1) that can lead to sensitive data disclosure. The issue is described as a cleartext storage vulnerability paired with SQL injection. The CVSS 3.1 sco...

EUVD-2026-52554

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

Important: Red Hat Security Advisory: ldns security update

An update for ldns is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

PT-2026-67629

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

RHEL 9 : Satellite 6.19.3 Async Update (Important) (RHSA-2026:50221)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50221 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

PT-2026-67685

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

RHEL 10 : ldns (RHSA-2026:49836)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49836 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also defin...

Important: perl-DBI

Issue Overview: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl...

ALSA-2026:50108 Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

SUSE CVE-2026-17351

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's executesqlquery tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing...

CVE-2026-48330

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL...

CVE-2026-48326

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-48326

Adobe Campaign Classic (ACC) is affected by an SQL Injection (Improper Neutralization of Special Elements used in an SQL Command) that could enable arbitrary code execution in the context of the current user. The issue can be exploited by a low-privileged attacker without user interaction, and th...

EUVD-2026-52434

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

CVE-2026-18737 Shlink Blind SQL Injection via tags/stats orderBy Parameter

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...