CVE-2026-49360: External Control of File Name or Path

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

EUVD-2026-63677

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-46682

BigBlueButton (open-source virtual classroom) is vulnerable to SQL injection in versions prior to 3.0.23 . The flaw resides in the refreshBreakoutRoomsVisibleForUsers method within BreakoutRoomUserDAO.scala, which interpolates meetingId and userId values directly into breakout room visibility que...

CVE-2026-55642

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-55642

In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

PT-2026-79060

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...

CVE-2026-46682: Improper Neutralization of Special Elements used in an SQL Command

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099479 advisory. Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including...

CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-15741

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-73069

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

EUVD-2026-56221

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

CVE-2026-5134

A flaw was found in CMS. This vulnerability, known as SQL injection, allows a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. This can lead to unauthorized access to sensitive data, modification of database content, and disrupti...