CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64880

CVE-2026-64880 corresponds to a blind SQL injection in Tenable Security Center, caused by unsanitized user input in report filtering parameters that is concatenated into SQL queries. This can enable unauthorized database read access. The CVE is listed with a base score of 7.1 (HIGH) on CVSS v3.1/...

CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-28310

creationtimestamp| type| source ---|---|--- 2026-07-21 16:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6afpcpwm2q 2026-07-26 21:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrldo4thtn23...

CVE-2026-16450

The CVE-2026-16450 issue affects zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead) in the MyBatis-Plus Tenant Plugin, specifically the function getTenantId in /api/system/sys/dept/page. The underlying problem is manipulation of the X-Tenant-Id argument, which leads to a...

EUVD-2026-46276

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the...

SUSE CVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-1771

creationtimestamp| type| source ---|---|--- 2026-07-21 10:53:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5nfg3ns62b 2026-07-21 14:14:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr5ylsgfxk2o...

CVE-2026-63963

creationtimestamp| type| source ---|---|--- 2026-07-21 09:28:48+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr5in7swgl2p 2026-07-21 09:28:51+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr5incph7d25 2026-07-21 09:28:54+00:00| seen|...

Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d748af7546aacbfca356759d4c81386f113a32dfc80ff8bb75da3eb3c8b4358d rasterkit-demo ships a CLI entry point rasterkit-demo whose rundemo function imports demochannelwindows from PIL.data and passes the returned buffer ...

CVE-2026-16336

Technical details about CVE-2026-16336 are not publicly available in the provided documents. Monitor for updates from trinodb/trino project and CVE listings.

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

CVE-2026-59238

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

CVE-2026-59238

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

EUVD-2026-45940

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-16244

The CVE-2026-16244 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability affects the file /prescriptionorderreport.php where manipulation of the delid argument enables SQL injection. The issue is exploitable remotely, and the exploit has been publicly disclosed. Connected ...

PT-2026-61607

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.0 Description Stored Cross-site Scripting occurs in the client-side report rendering functions renderPreview, renderEditor, and renderAuditData located in js/app.js. A remote, authenticated attacker can...