GHSA-465G-FH3V-9JW4 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the format and formatmap functions of Python string subclasses. An attacker can access sensitive information by supplying crafted format strings that leverage unrestricted attribute and item access...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-75523

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

EUVD-2026-82101

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

CVE-2026-92480

CVE-2026-92480 affects the Linux kernel in the scsi ufs core subsystem. Two related out-of-bounds read issues exist in string descriptor handling: first, utf16s_to_utf8s() expects a count of UTF-16 code units but receives a byte count, which can cause it to read beyond the descriptor buffer; seco...

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

EUVD-2026-81898

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523

Steeltoe prior to 4.3.0 has a disclosure vulnerability in the /actuator/httpexchanges endpoint. The MaskedUri component masks URI user information but does not inspect query strings. When the Management:Endpoints:HttpExchanges:IncludeQueryString setting is enabled, recorded request URIs can leak ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

CVE-2026-86864 pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

EUVD-2026-81896

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

EUVD-2026-81694

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86862

pgAdmin 4 's Restore and Maintenance tools were vulnerable to connection-string injection through the database field, passed directly as --dbname to pg_restore/psql. Because libpq expands a database name containing = into a full connection string, an attacker-supplied value like host=attacker.exa...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...

CVE-2026-92984

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the...