PT-2026-44064

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0 Description The fetchToken function in the OAuth2 SDK performs a POST request to a URL provided by the builder using node-fetch. This process bypasses the isBlacklisted check used by all other outbound fetch...

CVE-2026-9617: Improper Neutralization of Special Elements used in an SQL Command

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column identifier. If a superuser calls the k-anonymity function, the malicious code is executed with superuser privileges. The risk is higher wit...

CVE-2026-48151: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the bo...

AlmaLinux 10 : mysql8.4 (ALSA-2026:20693)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:20693 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysq...

postgresql: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

A flaw was found in PostgreSQL CREATE TYPE handling for multirange types. The database failed to properly verify schema CREATE privileges during multirange type creation. An authenticated database user could exploit this issue to hijack queries that rely on searchpath resolution for user-defined ...

biobb-io (>=0.0.1, <=0.0.8), biobb-model (>=0.0.1, <=0.0.10) +3 more potentially affected by CVE-2026-44897 via mistune (0.7.4)

mistune PYPI version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - biobb-io =0.0.1, =0.0.1, =0.2.1, =2.2.20170208112505, =2.7.20181012180226 Source cves: CVE-2026-44897 Source advisory: OSV:PYSEC-2026-2207...

biobb-io (>=0.0.1, <=0.0.8), biobb-model (>=0.0.1, <=0.0.10) +3 more potentially affected by CVE-2026-44899 via mistune (0.7.4)

mistune PYPI version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - biobb-io =0.0.1, =0.0.1, =0.2.1, =2.2.20170208112505, =2.7.20181012180226 Source cves: CVE-2026-44899 Source advisory: OSV:PYSEC-2026-2209...

biobb-io (>=0.0.1, <=0.0.8), biobb-model (>=0.0.1, <=0.0.10) +3 more potentially affected by CVE-2026-44898 via mistune (0.7.4)

mistune PYPI version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - biobb-io =0.0.1, =0.0.1, =0.2.1, =2.2.20170208112505, =2.7.20181012180226 Source cves: CVE-2026-44898 Source advisory: OSV:PYSEC-2026-2208...

mysql: Information Schema unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with...

mysql: Information Schema unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with...

ALSA-2026:20693 Moderate: mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: mysql:...

RHEL 10 : mysql8.4 (RHSA-2026:20693)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20693 advisory. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld an...

Malicious code in ts-schema-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d68e7e22dfa399a34405dd3c5824b27aa46ef7773d2bad7b4b698c77f17ccf1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4329 Malicious code in ts-schema-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d68e7e22dfa399a34405dd3c5824b27aa46ef7773d2bad7b4b698c77f17ccf1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview ts-schema-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in ts-schema-config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-44288 DESCRIPTION: protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2026-46374 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2026-46374 Source advisory:...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2026-46373 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2026-46373 Source advisory:...

com.squareup.wire:wire-grpc-client-jvm (4.0.0-alpha.8), com.squareup.wire:wire-reflector-jvm (4.0.0-alpha.8) +1 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (4.0.0-alpha.8)

com.squareup.wire:wire-runtime-jvm MAVEN version 4.0.0-alpha.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime-jvm and may be impacted: - com.squareup.wire:wire-grpc-client-jvm 4.0.0-alpha.8 -...