PT-2026-113611

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY STRING / REQUEST URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-42093: Improper Neutralization of Special Elements used in an SQL Command

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130092)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130092 advisory. The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by...

RHEL 8 : python36:3.6 (RHSA-2026:82858)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82858 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-73796: SQL Injection: Hibernate

A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...

RockyLinux 8 : python36:3.6 (RLSA-2026:82858)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

MAL-2026-17879 Malicious code in @flexmr/ui (npm)

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...

Malicious code in @flexmr/ui (npm)

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...

CVE-2026-107370

The auth0-lock library is vulnerable to improper request handling during Active Directory logins. When a username consists of a domain without a local part, the library incorrectly initiates the authentication transaction using a GET request instead of a POST request. This causes sensitive user-s...

CVE-2026-16753

Lowcoder versions up to and including 2.4.10 are vulnerable to a cross-tenant authorization bypass in the LibraryQuery API service layer. The flaw stems from a failure to enforce organization-scope checks, allowing authenticated users with admin or dev roles to execute or retrieve metadata for li...

CVE-2026-16753 CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-16753 CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-109607

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-93294

The Azure Monitor data source contains a vulnerability where a user with query access can leverage its resource proxy as an unintended proxy. This allows the user to call Azure Resource Manager APIs beyond the scope required by Grafana , performing actions using the data source's Azure identity ....

CVE-2026-110110

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...

CVE-2026-110110

JetLinks Community through version 2.10.0 is vulnerable to a missing authorization flaw (CWE-862) in the AlarmConfigController . Specifically, the _enable and _disable endpoints lack the required save action annotation . This allows users with only query access to toggle alarms by ID, potentially...

CVE-2026-96299

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

CVE-2026-103965

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...