Archive
28 July 2026
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
Critical 9.8
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a…
-
Critical 9.1
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files…
-
Critical 9.1
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP a…
-
Critical 9.8
IBM WebSphere Application Server is affected by a privilege escalation
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
-
Critical 9.8
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
-
Critical 9.1
OS command injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
-
Critical 9.1
OS Command Injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
-
Critical 9.3
Path Traversal in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
-
Critical 9.4
Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: …
-
Critical 10.0
terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This…
-
Critical 9.0
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table'…
-
Critical 9.0
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscri…
-
Critical 9.2
DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a <template> element through i…
-
Critical 9.8
Apache Axis2/Java: deserialization of untrusted Data
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated …
-
Critical 10.0
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.
-
Critical 9.8
SQL injection via unauthenticated GetGridData endpoint
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
-
Critical 9.4
CVE-2026-11841
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file…
-
Critical 10.0
Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
-
Critical 9.8
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. Thi…
-
Critical 9.8
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an admin…