CVE-2026-75959: Improper Neutralization of Special Elements used in an SQL Command

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

Linux Distros Unpatched Vulnerability : CVE-2026-61818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted te...

CVE-2026-13200: Improper Neutralization of Special Elements used in an SQL Command

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191: Improper Neutralization of Special Elements used in an SQL Command

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-95776

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied inp...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

Linux Distros Unpatched Vulnerability : CVE-2026-61817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo,...

PT-2026-95798

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description Authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post ID parameter is not sufficiently escaped and the SQL...

CVE-2026-84105

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-84239

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-84082

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84064

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84073

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-81933

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact ...

CVE-2026-80441

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting...

CVE-2026-81626

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-81656

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-76899

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

CVE-2026-61820

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key column names from pgattribute.attname with double quotes without escaping embedded double-quote characters. A partmanuser who owns a template...