golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-63637 Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL...

CVE-2026-63637

CVE-2026-63637 affects Dgraph. Prior to 25.3.8, the may beQuoteArg logic in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, enabling a crafted GraphQL query or mutation filter to inject DQL operators, disclos...

CVE-2026-63637 Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL...

CVE-2026-19071

Technical details about CVE-2026-19071 are not publicly available in the provided documents. Monitor for updates from linked sources, as no affected versions, root cause, or remediation details are included here.

CVE-2026-15256

The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-65508

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

ALPINE-CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-66447

CVE-2026-66447 : Unauthenticated SQL Injection in WordPress File Upload plugin

EUVD-2026-53964

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-19021

SourceCodester Computer Repair Shop Management System 1.0 is affected by a remote SQL injection in the file /classes/Master.php?f=delete_product, caused by manipulated ID parameter. The vulnerability can be exploited without authentication and has publicly disclosed exploit details. No patch/reme...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

RLSA-2026:49836 Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

RLSA-2026:50108 Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

EulerOS 2.0 SP13 : golang (EulerOS-SA-2026-3017)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 If a trusted template...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic (CVE-2025-36122)

Summary IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to AUTOMATIClimit. Vulnerability Details CVEID:CVE-2025-36122 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes DB2 Connect Server...