CVE-2026-112064 SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

CVE-2026-112064 SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

EUVD-2026-104874

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

CVE-2026-73964: Oracle Database: Critical Patch Update - October 2026

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and 21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to compromise RDBMS. Successful...

PT-2026-118508

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2 Description A client-side prototype pollution issue exists in the apos.http.parseQuery function. The parser fails to sanitize the proto , constructor, and prototype keys when processing URL...

PT-2026-118301

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

EUVD-2025-26366

A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely...

BIT-PARSE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...

CVE-2026-108776

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

CVE-2026-108776 Apache Kylin: tables/names SparkSQL injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

EUVD-2026-104145

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

CVE-2026-108776

A SQL Injection vulnerability exists in Apache Kylin affecting versions 4.0.0 through 5.0.4 . The flaw is caused by the improper neutralization of special elements used in an SQL command within the tables/names SparkSQL component. The impact is considered moderate when the Kylin service is operat...

MAL-2026-17412 Malicious code in xzvexpzcbailey (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

mariadb: mariadb: Information disclosure via embedded null bytes in query cache plugin

A flaw was found in MariaDB. An authenticated user can execute a database query containing embedded null bytes, which misleads the query cache information qcinfo plugin. When the cached query details are later read from the information schema, the server accesses memory beyond the allocated buffe...

diario-commandline-tools

diario-commandline-client What is this? Assumptions Installation Setup project Usage What is this? A utiliy repository created to ease bulk diario API consumption. Currently these functions are fully implemented: Upload a file PDF or Microsoft Office document Upload a complete directory of files...

MAL-2026-17372 Malicious code in @ostyado/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @ostyado/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

PT-2026-117451

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to s...