CVE-2026-79848

The AOS-8 operating system is vulnerable to unauthenticated SQL injection vulnerabilities that can lead to Remote Code Execution . While the provided documents do not specify the exact affected component or root cause, the vulnerability allows for remote exploitation without authentication. No sp...

CVE-2026-115416

Amazon Athena engine version 3 contained incorrect authorization checks during query processing. This vulnerability could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Notably, query results and data stored in Ama...

CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...

EUVD-2026-108258

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...

OESA-2026-4422 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4423 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4421 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4420 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

GHSA-7587-9684-52R6 mem0ai Databricks vector store vulnerable to SQL injection

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

SQL Injection

Overview mem0ai is a Long-term memory for AI Agents Affected versions of this package are vulnerable to SQL Injection via the Databricks vector store in mem0/vectorstores/databricks.py, where user-controlled payload values and vector IDs are interpolated directly into SQL statements without...

Vulnerabilities found in Cisco Expressway Series devices

Cisco has identified several vulnerabilities in the Cisco Expressway Series. These vulnerabilities involve insufficient authorization checks during Mobile and Remote Access provisioning, allowing unauthorized external attackers to gain access to sensitive information. Additionally, there is a...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115332

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115331

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115324

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

CVE-2026-112822

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

CVE-2025-71434

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...

CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...