CVE-2026-59962 | Medium | 6.5 | 2026-10-16 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_f… |
CVE-2026-102988 | Medium | 5.3 | 2026-10-13 | Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by Is… |
CVE-2026-106119 | | | 2026-10-06 | LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an un… |
CVE-2026-105799 | | | 2026-10-06 | LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediS… |
CVE-2026-105681 | Medium | 6.5 | 2026-10-05 | Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to… |
CVE-2026-105675 | High | 7.5 | 2026-10-05 | Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret toke… |
CVE-2026-105652 | Low | 3.1 | 2026-10-05 | Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' h… |
CVE-2026-104956 | Medium | 5.3 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters… |
CVE-2026-73976 | | | 2026-10-01 | djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the sea… |
CVE-2026-73975 | | | 2026-10-01 | djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL int… |
CVE-2026-103289 | Medium | 6.5 | 2026-10-01 | Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not aut… |
CVE-2026-103258 | Medium | 6.8 | 2026-10-01 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes… |
CVE-2026-103250 | High | 8.1 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node t… |
CVE-2026-81914 | Medium | 4.3 | 2026-09-29 | Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, with… |
CVE-2026-100631 | High | 7.5 | 2026-09-26 | Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication l… |
CVE-2026-97228 | Low | 2.7 | 2026-09-25 | Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/exp… |
CVE-2026-91133 | Medium | 6.5 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metac… |
CVE-2026-96744 | High | 7.1 | 2026-09-24 | Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supp… |
CVE-2026-93760 | High | 8.2 | 2026-09-18 | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In… |
CVE-2026-20284 | Critical | 9.1 | 2026-09-16 | A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due t… |
CVE-2026-91937 | High | 7.5 | 2026-09-15 | Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated… |
CVE-2026-55253 | High | 7.7 | 2026-09-14 | LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongo… |
CVE-2026-88036 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file ide… |
CVE-2026-88034 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file i… |
CVE-2026-88033 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file… |
CVE-2026-88031 | High | 8.1 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file id… |
CVE-2026-88030 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file… |
CVE-2026-88029 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured fil… |
CVE-2026-88028 | Medium | 6.5 | 2026-09-10 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-… |
CVE-2026-88027 | High | 7.1 | 2026-09-10 | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a c… |
CVE-2026-88026 | Medium | 6.5 | 2026-09-10 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied chara… |
CVE-2026-88025 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file id… |
CVE-2026-88024 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file… |
CVE-2026-88023 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file… |
CVE-2026-88022 | High | 7.7 | 2026-09-10 | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filt… |
CVE-2026-82060 | Medium | 5.4 | 2026-09-08 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operat… |
CVE-2026-62906 | High | 7.4 | 2026-09-03 | Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a ne… |
CVE-2026-85167 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Qu… |
CVE-2026-63138 | Medium | 6.5 | 2026-09-01 | Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An auth… |
CVE-2026-79483 | Medium | 5.3 | 2026-08-31 | FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attack… |
CVE-2026-78691 | | | 2026-08-30 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, st… |
CVE-2026-77846 | | | 2026-08-30 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to… |
CVE-2026-81528 | Medium | 5.4 | 2026-08-27 | A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a repl… |
CVE-2026-81527 | Medium | 6.5 | 2026-08-27 | A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu… |
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2026-59319 | Medium | 4.3 | 2026-08-27 | RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()… |
CVE-2026-56096 | | | 2026-08-25 | The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors… |
CVE-2026-56094 | | | 2026-08-25 | The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and… |
CVE-2026-77070 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the… |
CVE-2026-76363 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the… |
CVE-2026-76349 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Process… |
CVE-2026-76331 | High | 8.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Proces… |
CVE-2026-76329 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into openi… |
CVE-2026-76327 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated… |
CVE-2026-76320 | Medium | 5.9 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Proce… |
CVE-2026-76316 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search P… |
CVE-2026-76254 | High | 7.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search P… |
CVE-2026-73618 | High | 8.3 | 2026-08-13 | Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated… |
CVE-2026-73617 | High | 7.1 | 2026-08-13 | Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handleba… |
CVE-2026-70395 | | | 2026-08-09 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they ca… |
CVE-2026-63637 | High | 8.6 | 2026-08-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into ge… |
CVE-2026-48121 | Medium | 6.7 | 2026-08-04 | @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vuln… |
CVE-2025-60357 | High | 8.1 | 2026-07-17 | AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint. |
CVE-2026-8649 | Medium | 6.4 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit… |
CVE-2026-10698 | High | 7.2 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit… |
CVE-2026-44840 | High | 7.5 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Qu… |
CVE-2026-40141 | Critical | 9.9 | 2026-07-06 | A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of cer… |
CVE-2026-46591 | High | 8.2 | 2026-07-06 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.
The camel-neo4j producer builds the Cypher WHER… |
CVE-2026-54350 | Critical | 10.0 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing M… |
CVE-2026-45689 | Critical | 9.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an u… |
CVE-2026-45688 | Critical | 9.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rock… |
CVE-2026-54019 | Medium | 6.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks… |
CVE-2026-47835 | High | 8.6 | 2026-06-15 | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Af… |
CVE-2026-49482 | Medium | 4.3 | 2026-06-12 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard charac… |
CVE-2026-47181 | | | 2026-06-11 | PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any auth… |
CVE-2026-53674 | High | 7.1 | 2026-06-10 | BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, all… |
CVE-2026-41697 | Medium | 4.8 | 2026-06-10 | Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Que… |
CVE-2026-41696 | Medium | 5.9 | 2026-06-10 | Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An… |
CVE-2026-40102 | Medium | 6.5 | 2026-05-20 | Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly… |
CVE-2026-27886 | High | 7.5 | 2026-05-14 | Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query paramete… |
CVE-2026-44425 | Medium | 5.4 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter prope… |
CVE-2026-42156 | | | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote atta… |
CVE-2026-42316 | Medium | 6.5 | 2026-05-11 | kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sani… |
CVE-2026-33566 | Medium | 4.3 | 2026-04-27 | There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be al… |
CVE-2026-41328 | Critical | 9.1 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full re… |
CVE-2026-41327 | Critical | 9.1 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full re… |
CVE-2026-41274 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided inp… |
CVE-2026-6626 | Medium | 6.3 | 2026-04-20 | A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate… |
CVE-2026-40352 | High | 8.8 | 2026-04-17 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attack… |
CVE-2026-40351 | Critical | 9.8 | 2026-04-17 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime valid… |
CVE-2026-34973 | Medium | 5.3 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_str… |
CVE-2026-33980 | High | 8.3 | 2026-03-27 | Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/… |
CVE-2026-22558 | High | 7.7 | 2026-03-19 | An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to esc… |
CVE-2026-3023 | High | 8.8 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. This vulnera… |
CVE-2026-3022 | Medium | 6.5 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/hospitalization/generate-hospi… |
CVE-2026-3021 | Medium | 6.5 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/centro/equipo/empleado'. This… |
CVE-2026-32248 | Critical | 9.8 | 2026-03-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated… |
CVE-2026-32247 | High | 8.1 | 2026-03-12 | Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerabi… |
CVE-2026-31825 | Medium | 5.3 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied… |
CVE-2026-29793 | Critical | 9.8 | 2026-03-10 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can s… |