CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

PT-2026-110764

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

EulerOS 2.0 SP13 : perl-XML-LibXML (EulerOS-SA-2026-4181)

According to the versions of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte...

EulerOS 2.0 SP11 : perl-XML-LibXML (EulerOS-SA-2026-4273)

According to the versions of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte...

EulerOS 2.0 SP11 : perl-XML-LibXML (EulerOS-SA-2026-4363)

According to the versions of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte...

CVE-2026-109347: Improper Control of Generation of Code

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

EulerOS 2.0 SP13 : perl-XML-LibXML (EulerOS-SA-2026-4090)

According to the versions of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte...

CVE-2026-101094

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

CVE-2026-101094

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

EUVD-2026-95752

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

CVE-2026-101094

The Affinity by Canva application, prior to version 3.3.1 (October 2026 release), contains an unbounded over-read vulnerability in Story::GlyphString::Add . The issue stems from the software's failure to correctly handle incomplete UTF-8 character sequences while parsing text within Affinity docu...

CVE-2026-101094

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

CVE-2026-101094: Buffer Over-read

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

Exploit for Path Traversal in Oracle Glassfish_Server

GlassFish 4.1 Admin Console Arbitrary File Read CVE-2017-1000...

RHLW-2026-C45D2A64E2C0626E Lightwell Security Advisory: android-mail 1.6.7.rhlw-00001

Red Hat Lightwell has released com.sun.mail:android-mail 1.6.7.rhlw-00001 with a backported security fix. CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. This patched...

SUSE CVE-2026-107169

A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service DoS...