CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injection SQLi vulnerability affecting the WP Ticket Customer Support Ticket System & Helpdesk plugin for WordPress up to and including version 6.0.4.The flaw occurs because the plugin takes the WordPress search parameter s and concatenates it...

unbound: Unbound: Denial of service due to memory corruption under specific configurations.

A flaw was found in Unbound, a validating, recursive, and caching Domain Name System DNS resolver. When configured with specific modules and under heavy load, a memory corruption vulnerability can occur due to improper handling of view names during subquery processing. This issue could lead to a...

unbound: Unbound: Denial of service due to memory corruption under specific configurations.

A flaw was found in Unbound, a validating, recursive, and caching Domain Name System DNS resolver. When configured with specific modules and under heavy load, a memory corruption vulnerability can occur due to improper handling of view names during subquery processing. This issue could lead to a...

EUVD-2026-110515

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...

CVE-2026-116807

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...

CVE-2026-116807 OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...

CVE-2026-116807 OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...

PT-2026-125513

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project id WHERE clause and re...

CentOS Linux 7 [TuxCare] Security Update: mariadb / mariadb-bench / mariadb-devel / mariadb-embedded / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792022281)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792022281 advisory. - getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657 - MariaDB...

Astra Linux – vulnerability in mariadb-10.3

In MariaDB versions prior to 10.6.3, savewindowfunctionvalues allows an application crash due to improper handling of withwindowfunc=true when used with a subquery...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB version 10.5.9 allows a SetVar.cc application to crash due to certain uses of the UPDATE statement in conjunction with a nested subquery...

CVE-2026-104462

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

EUVD-2026-91473

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

CVE-2026-76848

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2026-80857

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated...

CVE-2026-52863

A flaw was found in Unbound, a validating, recursive, and caching Domain Name System DNS resolver. When configured with specific modules and under heavy load, a memory corruption vulnerability can occur due to improper handling of view names during subquery processing. This issue could lead to a...

SUSE CVE-2026-52863

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

ALPINE-CVE-2026-52863

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...