CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...

CVE-2026-44349

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...