CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK snowpark-python versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database...

CVE-2026-59257

This CVE affects n8n before 1.123.61 and 2.x before 2.27.4, specifically the legacy MySQL v1 node’s executeQuery operation. The root cause is that evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, enabling SQL injection when a workflo...

CVE-2026-8307

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported...

EUVD-2026-42223

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-55574

A flaw was found in vLLM, a high-throughput and memory-efficient inference and serving engine for large language models LLMs. A remote attacker could exploit this vulnerability by providing a specially crafted regular expression to the structuredoutputs.regex API parameter. This adversarial regex...

EUVD-2026-42163

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the eventerverificationcode user meta field when a user requests a password reset. The plaintext key...

PT-2026-56410

Name of the Vulnerable Software and Affected Versions Mediküm Web versions prior to 08072026 Description Mediküm Web contains an SQL injection flaw resulting from improper neutralization of special elements used in SQL commands. This occurs due to inadequate input validation or parameterization,...

ROS-20260708-73-0032

The vulnerability of the sqlExpressions function on the Grafana monitoring and observation platform relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to read arbitrary files...

CVE-2026-39179

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...

The vulnerability of the dual-way inverter series for KACO Blueplanet GridSave storage systems lies in the lack of protective measures for the SQL query structure, allowing attackers to enhance their privileges within the local network.

The vulnerability of the dual-way inverter series for KACO Blueplanet GridSave energy storage systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow attackers to enhance their privileges within the local network...

CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byt...

EUVD-2026-42096

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres without applying the SQL literal validation and escaping used by other filter paths,...

CVE-2026-55635 DataEase: Authenticated SQL Injection in Chart Quota Filters

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres without applying the SQL literal validation and escaping used by other filter paths,...

CVE-2026-55635

DataEase contains an authenticated SQL injection in chart quota filters prior to version 2.10.24. The vulnerability arises when quota and Y-axis filters embed attacker-controlled values directly into generated SQL within Quota2SQLObj.getYWheres(), without applying the SQL literal validation and e...

PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...

Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting LibraryComponent: parsl.monitoring.visualizationVulnerability Type: SQL Injection CWE-89Severity: High CVSS Rating Recommended: 7.5 - 8.6URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.pySummaryA SQL Injection...

Frappe has possibility of SQL injection due to improper validations

ImpactAn SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. WorkaroundsUpgrading is required, no other workaround is present. CreditsThanks to Thanh of Calif.io for reporting the issue...

PYSEC-2026-1391 Frappe has possibility of SQL injection due to improper validations

Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present...

PYSEC-2026-1855 python-sql SQL injection vulnerability

A vulnerability was found in python-sql where unary operators do not escape non-Expression like And and Or which makes any system exposing those vulnerable to an SQL injection attack...

SQL injection in litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...