Plone 4.0.x < 4.3.20 / 5.0.x < 5.1.7 / 5.2.x < 5.2.2 Multiple Vulnerabilities (HF 20200121)

The version of Plone installed on the remote host is 4.0.x prior to 4.3.20, 5.0.x prior to 5.1.7, or 5.2.x prior to 5.2.2. It is, therefore, affected by the following vulnerabilities: - An open redirect on the login form and possibly other places allows an attacker to craft a link to a Plone Site...

RHEL 10 : mariadb-connector-c (RHSA-2026:43505)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43505 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes:...

ALSA-2026:43505 Important: mariadb-connector-c security update

The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 For more details...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.6.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory. - Tenable Security Center is affected by a SQL injection vulnerability...

PT-2026-63784

Name of the Vulnerable Software and Affected Versions AI Copilot – Content Generator versions prior to 1.5.5 Description This issue is a generic SQL Injection occurring due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated...

PT-2026-70177

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 Description The PostgresTrigger node fails to properly escape user-supplied identifier parameters when interpolating them into SQL statements. This allows...

CVE-2026-61128

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

CVE-2026-60840

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demand...

CVE-2026-16484

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2877 more potentially affected by unknown CVE via typeorm (>=0.0.2-alpha.43, <=0.3.30)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-TYPEORM-18170276...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2877 more potentially affected by CVE-2026-73651 via typeorm (>=0.0.2-alpha.43, <=0.3.30)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: CVE-2026-73651 Source advisory: OSV:GHSA-2RP8-MM9Q-FP49...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +6 more potentially affected by unknown CVE via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =0.2.0, =1.1.43, =1.1.45 Source cves: unknown CVE Source advisory:...

EUVD-2026-46431

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-16484

SourceCodester Class and Exam Timetabling System 1.0 is affected by a SQL injection in the /edit_subjecta.php parameter ID. The vulnerability arises from manipulating the ID argument, enabling remote exploitation. The exploit has been published and may be used. CVSS metrics in the entry indicate ...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-63080

Aptabase (through commit 5a89368) contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. The attack can be carried out by supplying malic...

CVE-2016-20096

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

CVE-2026-55082

Summary: CVE-2026-55082 affects DHIS2 SQL View filters. An authenticated user who has SQL View access could supply crafted filter values that are interpolated into generated SQL, allowing manipulation of SQL generated for SQL View filters and potentially accessing data outside the intended SQL Vi...