220088 matches found
CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...
CVE-2026-73408
Budibase (open-source low-code platform) is affected up to version 3.39.18 in the MySQL integration code path, specifically packages/server/src/integrations/mysql.ts where multipleStatements is enabled and an unescaped tableName is inserted into a DESCRIBE statement. An attacker able to create a ...
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
CVE-2026-72853
Budibase prior to 3.40.0 is affected by a SQL injection in the Oracle datasource connector’s post-write row lookup, due to failure to escape table names in identifiers. An attacker with write access on a table whose name contains a double-quote can inject SQL that executes as the datasource’s dat...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72851
Budibase before 3.40.0 contains an unauthenticated SQL injection in webhook-triggered automations using EXECUTE_QUERY steps. An attacker can POST JSON to the webhook trigger endpoint to inject SQL payloads that run with builder-configured database credentials, enabling data exfiltration, modifica...
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
CVE-2026-73663
The CVE concerns FreePBX missedcall module (affected in 16.0.0–16.0.11 and 17.0.4) where inbound Caller ID name from crafted SIP From headers is inserted into missedcalllog without escaping or bound parameters, enabling unauthenticated SQL injection that can corrupt the database and modify admini...
EUVD-2026-58486
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73427 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, ruby4.0-rails...
CVE-2026-73418 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...
GHSA-HF6X-8P5F-CGMF vulnerabilities
Vulnerabilities for packages: apicurio-registry, akhq, opensearch, thingsboard, nrjmx, druid, cassandra-reaper...
CVE-2026-73651
creationtimestamp| type| source ---|---|--- 2026-08-13 20:35:04+00:00| published-proof-of-concept| https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49...
CVE-2026-73490 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, pghero-fips, ruby3.3-rails, pghero, ruby3.2-rails, ruby4.0-rails...
CVE-2026-73491 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, pghero-fips, ruby3.3-rails, pghero, ruby3.2-rails, ruby4.0-rails...