CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64880

CVE-2026-64880 corresponds to a blind SQL injection in Tenable Security Center, caused by unsanitized user input in report filtering parameters that is concatenated into SQL queries. This can enable unauthorized database read access. The CVE is listed with a base score of 7.1 (HIGH) on CVSS v3.1/...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-28310

creationtimestamp| type| source ---|---|--- 2026-07-21 16:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6afpcpwm2q...

CVE-2026-16450

The CVE-2026-16450 issue affects zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead) in the MyBatis-Plus Tenant Plugin, specifically the function getTenantId in /api/system/sys/dept/page. The underlying problem is manipulation of the X-Tenant-Id argument, which leads to a...

EUVD-2026-46276

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the...

CVE-2026-1771

creationtimestamp| type| source ---|---|--- 2026-07-21 10:53:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5nfg3ns62b 2026-07-21 14:14:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr5ylsgfxk2o...

CVE-2026-16336

Technical details about CVE-2026-16336 are not publicly available in the provided documents. Monitor for updates from trinodb/trino project and CVE listings.

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

CVE-2026-59238

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-16244

The CVE-2026-16244 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability affects the file /prescriptionorderreport.php where manipulation of the delid argument enables SQL injection. The issue is exploitable remotely, and the exploit has been publicly disclosed. Connected ...

EUVD-2026-45940

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

SUSE CVE-2026-16206

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function loadidtoken of the file oauth2provider/oauth2validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the...

CVE-2026-64182

creationtimestamp| type| source ---|---|--- 2026-07-19 17:12:32+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqzbmmttji2c 2026-07-19 18:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzehgdfwk2i...

CVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-64122

In the Linux kernel, CVE-2026-64122 affects the mlx5e driver (net/mlx5e). The vulnerability is a use-after-free in mlx5e_tx_reporter_timeout_recover, where sq->netdev is accessed after mlx5e_safe_reopen_channels() tears down the channel and its embedded SQs. The fix replaces three sq->netde...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...