PT-2026-71707

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

Vulnerability in client (CVE-2026-6464)

PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fai...

Linux Distros Unpatched Vulnerability : CVE-2026-15741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect...

Exploit for SQL Injection in Dovecot

CVE-2026-24031: Dovecot SQL authentication bypass authenticat...

CVE-2026-19004

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in...

CVE-2026-10543 IBM® Db2® is vulnerable to privilege escalation with a specially crafted query

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

EUVD-2026-57621

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

CVE-2026-73301

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:23+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4...

CVE-2026-73409

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:08+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6...

EUVD-2026-57551

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

CVE-2026-73329

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-73331

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers c...

CVE-2026-73332

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-72807

SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...

CVE-2026-67579

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-17111

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

EUVD-2026-57549

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-19502

CVE-2026-19502 affects MongoDB SQL Schema Builder CLI. The issue is insufficient redaction of sensitive startup/connection configuration in diagnostic output (stdout and log files), allowing a local user with access to terminals or logs to view authentication material. The documentation provided ...