sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

GHSA-4FQR-96Q8-XRFX sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

CVE-2026-128084

The sqlite3-ruby library is vulnerable to SQL query truncation on 64-bit platforms because it casts Ruby string lengths (long) to integers before passing them to SQLite. Strings of 4 GiB (2^32 bytes) or larger cause the length to wrap, leading SQLite to process only a prefix. This can result in d...

CVE-2026-128084 sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...

CVE-2026-128084 sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...

CVE-2026-126196 pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, querydatabase on a readonly connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query...

CVE-2026-126196 pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, querydatabase on a readonly connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query...

CVE-2026-126196

The pgEdge Postgres MCP Server (prior to version 1.1.0 ) contains a vulnerability where the read_only mode can be bypassed via SQL statement smuggling through the query_database function. The root cause is that pgx Exec (without bind parameters) may select PostgreSQL's simple query protocol, allo...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2026-126619

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

EUVD-2026-123336

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-126619

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-126619 Misinterpretation of Input in hMailServer

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-126619: Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7…

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

EUVD-2026-119250

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

EUVD-2026-119249

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

PT-2026-139458

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

CVE-2026-121262

A flaw was found in phpMyAdmin's SQL parser. An improper type conversion vulnerability exists in the EXPLAIN statement parser when processing specific token arguments. A remote attacker can exploit this flaw by submitting a specially crafted SQL query, leading to an unhandled exception and causin...

CVE-2026-122315

A flaw was found in Kyverno. An unauthenticated remote attacker can cause a Denial of Service DoS by supplying a crafted attestation statement containing an unexpected data type in an Open Container Initiative OCI manifest. Processing this payload triggers an internal application crash that halts...