2901 matches found
CVE-2026-114652
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
EUVD-2026-108323
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114652
The MongoDB C# Driver contains a data-query-logic neutralization weakness within the update-statement construction component . This vulnerability allows an attacker who can influence application-supplied values to have those values interpreted as query/update logic rather than literal data. A use...
EUVD-2026-108258
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...
CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...
CVE-2026-115416
Amazon Athena engine version 3 contained incorrect authorization checks during query processing. This vulnerability could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Notably, query results and data stored in Ama...
EUVD-2020-31284
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...
EUVD-2026-106220
Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite component: Total Compensation Statement. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-120157
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...
CVE-2026-101821
Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite component: Total Compensation Statement. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
CVE-2026-101821
A vulnerability exists in the Total Compensation Statement component of the Oracle Compensation Workbench product within Oracle E-Business Suite (affected versions 12.2.3-12.2.15 ). A low-privileged attacker with network access via HTTP can exploit this flaw, which requires human interaction from...
CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...
CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...
CVE-2026-113718
The virtualenv tool is vulnerable to code injection in versions prior to 21.14.9 . The issue exists in the POSIX xonsh activation quote() function, which uses repr() to write non-ASCII data into the UTF-8 activate.xsh script. When using legacy multibyte codecs like GBK or Big5 , a UTF-8 trail byt...
Oracle E-Business Suite: CVE-2026-101821: Critical Patch Update
Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite component: Total Compensation Statement. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
QVD-2026-56312
QVD-2026-56312 POC Condition: JeecgBoot ≤ 3.9.3 In JeecgBo...
Astra Linux – Vulnerability in Mariadb 10.3
MariaDB Server before version 10.7 is vulnerable to Denial of Service attacks. During the execution of the plugin/serveraudit/serveraudit.c method logstatementex, the held lock lockbigbuffer is not released properly, allowing local users to trigger a Denial of Service attack due to a deadlock...
CVE-2026-55684
The WeGIA web manager for charitable institutions is vulnerable to SQL Injection in the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint prior to version 3.8.6 . The application improperly handles form-encoded POST data via extract($_REQUEST), interpolating multiple parameters—inclu...