CVE-2026-93294: Unintended Proxy or Intermediary

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

CVE-2026-63316: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "notin" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34...

CVE-2026-110110: Missing Authorization

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...

CVE-2026-107370: Use of GET Request Method With Sensitive Query Strings

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

Cisco License On-Prem Unauthorized Access

The vulnerability in the web interface for managing Cisco License On-Prem previously known as Cisco Smart Software Manager On-Prem is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

PT-2026-111607

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1 Description Bridge tools do not consistently apply the read access-control list ACL to every returned field. Specifically, the tasks filter tool exposes group counts derived from denied notes, the makemd que...

PT-2026-111676

Name of the Vulnerable Software and Affected Versions SourceCodester Online Exam System version 1.0 Description An issue exists in the Login Endpoint within the file adminpanel/admin/query/loginExe.php. Remote manipulation of the username and pass arguments allows for SQL injection, a technique...

PT-2026-111327

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System affected versions not specified Description An authorization bypass exists in the Order Management component. A remote attacker can manipulate the ID argument within the mysqli query function to bypa...

PT-2026-111140

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description Insufficient validation of user-supplied input before its incorporation into a database query allows an authenticated user to inject arbitrary SQL commands. This could enable the...

CVE-2026-16753: Undefined Security Weakness

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753...

CVE-2026-109674

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-109649

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...

CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive informati...

CVE-2026-109647 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

CVE-2026-109638

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a SQL injection flaw in certain endpoints. The root cause is missing input validation , which allows authenticated attackers to submit specially crafted requests to manipulate database queries. This vulnerability ca...

CVE-2024-58389

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a nexturl cookie, so crafted login link...

CVE-2026-108923

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

CVE-2026-104332

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table...

CVE-2026-104332

IBM Db2 (Server edition) is vulnerable to a denial of service (DoS) condition when executing a specially crafted query involving a Materialized Query Table . The root cause is identified as a stack-based buffer overflow (CWE-121 ). Affected versions include 11.5.0 through 11.5.9 and 12.1.0 throug...