postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser

A flaw was found in PostgreSQL. An attacker with pgcreatesubscription rights can exploit a SQL injection vulnerability in the pgcreatesubscriber utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when pgcreatesubscriber is next run, leading to potential...

postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse

A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...

PT-2026-91443

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

EUVD-2026-75599

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

PYSEC-2026-3882 piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

CVE-2026-73694: Improper Neutralization of Special Elements used in an OS Command

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection via the downloadLocationScopingReport process. An attacker can execute arbitrary spreadsheet formulas in the context of a privileged user's spreadsheet...

Improper Cleanup on Thrown Exception

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception through the restore process. An attacker can cause permanent data loss by uploading a corrupted or invalid backup archive, resulting in...

CVE-2026-86748

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Custom CSS field due to incomplete sanitization that reverses HTML encoding on certain characters. An attacker can execute malicious CSS...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86480

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...

CVE-2026-86480

JetBrains Hub prior to version 2026.2.52442 is affected by a privilege escalation vulnerability. An unauthenticated attacker over the network could register a trusted service and subsequently gain superuser privileges , resulting in full compromise of confidentiality, integrity, and availability ...

CVE-2026-86480

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...

EUVD-2026-72496

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...

CVE-2026-86480

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...

CVE-2026-83534

A flaw was found in PostgreSQL Anonymizer. This vulnerability, located in the anon.anonymizedatabaseparallel function, allows an authenticated table owner to execute arbitrary code with superuser privileges. This could lead to a complete compromise of the database system. Mitigation If the...