Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,600 results · page 5 of 72
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55855 · Other software · mariadb-corporation · reported by GitHubMedium 6.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55854 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by definingCVE-2026-81490 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.3
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.
- Product
- BI Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Arc is an open, SQL-native time-series database for telemetry.CVE-2026-55678 · Other software · Basekick-Labs · reported by GitHubMedium 6.9
Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.shared_secret is not configured. The defaults in internal/config/config.go set cluster.enabled to false, cluster.cluster_name to arc-cluster, cluster.coordinator_addr to :9100, cluster.shared_secret to an empty value, and cluster.tls_enabled to false, while cmd/arc/main.go requires cluster.shared_secret only when cluster.replication_enabled is true. JoinRequest in internal/cluster/protocol/messages.go accepts attacker-controlled node_id, role, raft_addr, api_addr, and coord_addr values, plus optional auth_nonce, auth_timestamp, and auth_hmac fields. The join path in internal/cluster/coordinator.go validates HMAC authentication only when the configured shared secret is non-empty and otherwise proceeds after only the cluster-name check. An accepted node is marked healthy, added as a Raft voter or registered locally, and becomes available through internal/cluster/registry.go to the routing logic in internal/cluster/router.go. The forwardRequest path in internal/cluster/router.g
- Product
- arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadshCVE-2026-76797 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.8
The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.
- Product
- BI Connector Transition Readiness Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML.CVE-2026-76794 · Other software · MongoDB · reported by cna@mongodb.comMedium 4.8
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.
- Product
- BI Connector Transition Readiness Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55215 · Other software · mariadb-corporation · reported by GitHubHigh 7.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to CVE-2026-78500 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 5.1
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the drivCVE-2026-81524 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.3
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
- Product
- C Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.mongodb.org
Aug 27, 2026A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted withoCVE-2026-81523 · Other software · MongoDB · reported by cna@mongodb.comLow 2
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
- Product
- libmongocrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.mongodb.org
Aug 27, 2026The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping CVE-2026-81521 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
- Product
- GO Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgpkg.go.dev
Aug 27, 2026n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n.CVE-2026-54687 · Other software · DangerBlack · reported by GitHubMedium 6.1
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
- Product
- n8n-node-sqlite3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queriesCVE-2026-9668 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.3
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.
- Product
- SCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Tutor LMS: Does not validate values used to build a database queryCVE-2026-19094 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 25, 2026Webkul QloApps does not validate request parameters before a database query.CVE-2026-75498 · Other software · Webkul · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.6
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Aug 25, 2026Webkul QloApps does not validate request parameters before a database query.CVE-2026-75497 · Other software · Webkul · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.6
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Aug 25, 2026The extension fails to properly sanitize user input before using it in a database query.CVE-2026-77137 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.7
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
- Product
- Extension "Forms Export"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation.CVE-2026-56704 · Other software · vrana · reported by VulnCheckMedium 5.3
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions befoCVE-2026-34968 · Other software · vrana · reported by VulnCheckHigh 7.2
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intendCVE-2026-78370 · Other software · ransomlook · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Critical 9.2
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exported without requiring authentication. While limited filtering is performed for some entity databases, other exportable databases are returned directly without consistently applying the application's private-entity access restrictions. As a result, information associated with groups, markets, posts, or other records marked as private may be included in an export accessible to an unauthenticated requester. An attacker able to reach the RansomLook web application can request the affected export endpoint and retrieve data that should only be available to authorized users. Depending on the contents of the instance, this may disclose private ransomware intelligence, victim information, internal tracking data, or other information deliberately excluded from public views. The patch removes the legacy unauthenticated export route and introduces centralized authorization handling that distinguishes ordinary authenticated API access
- Product
- ransomlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privilegesCVE-2026-78155 · Other software · OnGres · reported by cve@gitlab.comCritical 9.9
privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges
- Product
- StackGres
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements modCVE-2026-76599 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Arc is an open, SQL-native time-series database for telemetry.CVE-2026-48106 · Other software · Basekick-Labs · reported by GitHubHigh 8.3
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.
- Product
- arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Arc is an open, SQL-native time-series database for telemetry.CVE-2026-48105 · Other software · Basekick-Labs · reported by GitHubHigh 8.3
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (`..`) rejection, no allowlist of legitimate prefixes, no scheme restriction (`s3://` vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.
- Product
- arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Arc is an open, SQL-native time-series database for telemetry.CVE-2026-48050 · Other software · Basekick-Labs · reported by GitHubHigh 8.8
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.
- Product
- arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Arc is an open, SQL-native time-series database for telemetry.CVE-2026-47735 · Other software · Basekick-Labs · reported by GitHubHigh 7.1
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O function family — `read_csv_auto`, `read_csv`, `read_json`, `read_json_auto`, `read_text`, `read_blob`, `glob`, `parquet_metadata`, `parquet_schema`, `read_xlsx`, etc. — was not blocked. RBAC table-reference extraction inspected only `FROM`/`JOIN` clauses, so scalar table functions in the `SELECT` list slipped past both layers. This is fixed in 2026.06.1 via a structural sandbox at the DuckDB layer. After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further `INSTALL`/`LOAD`. Already-loaded extensions remain callable. Some workarounds are available. Restrict API access to known-trusted networks via firewall rules or, as a temporary mitigation, add `read_csv*`/`read_json*`/`glob` etc. to `dangerousSQLPattern` in `internal/api/query.go`.
- Product
- arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unautCVE-2026-75928 · Other software · Brushfire · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.
- Product
- Online Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.brushfire.comraw.githubusercontent.com
Aug 21, 2026Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69502 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.CVE-2026-59657 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges oCVE-2026-68789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges oCVE-2026-68782 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.CVE-2026-66309 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.CVE-2026-55769 · Other software · cloudnative-pg · reported by GitHubCritical 9.4
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER could create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension WHERE extname = $1 to execute attacker-controlled functions as the postgres superuser. The same trust issue affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, operating system command execution through COPY ... FROM PROGRAM, and access to the pod ServiceAccount token. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
- Product
- cloudnative-pg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.CVE-2026-55765 · Other software · cloudnative-pg · reported by GitHubHigh 8.5
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
- Product
- cloudnative-pg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026dbx is a cross-platform database client for databases.CVE-2026-55642 · Other software · t8y2 · reported by GitHubCritical 9.8
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
- Product
- dbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability.CVE-2026-18274 · Other software · Heimdall Data · reported by zdi-disclosures@trendmicro.comHigh 7.2
Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.
- Product
- Database Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled tabCVE-2026-76635 · Other software · baserproject · reported by VulnCheckHigh 8.6
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credenCVE-2026-75920 · Other software · thorsten · reported by VulnCheckMedium 6
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 19, 2026phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and crCVE-2026-75919 · Other software · thorsten · reported by VulnCheckMedium 6.9
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared CVE-2026-73974 · Computers, phones & browsers · Linuxfabrik · reported by GitHubMedium 5.5
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through tha
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Portable Clusterware component of Oracle Database Server.CVE-2026-71102 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Portable Clusterware. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Portable Clusterware accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Portable Clusterware. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the RDBMS component of Oracle Database Server.CVE-2026-71100 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Portable Clusterware component of Oracle Database Server.CVE-2026-71064 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.6
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Portable Clusterware component of Oracle Database Server.CVE-2026-71063 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.6
Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Portable Clusterware. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the RDBMS component of Oracle Database Server.CVE-2026-71062 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.5
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modulCVE-2026-55426 · Computers, phones & browsers · Linuxfabrik · reported by GitHubHigh 7.8
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations.CVE-2026-53759 · Computers, phones & browsers · Linuxfabrik · reported by GitHubLow 2
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2026-65959 · Other software · vitessio · reported by GitHubMedium 5.3
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Valkey is a distributed key-value database.CVE-2026-63639 · Other software · valkey-io · reported by GitHubHigh 8.8
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
- Product
- valkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.