EventSourcingDB 1.3.0 adds a v2 API and faster queries
v1 stays until January 31, 2027, but a data directory opened by 1.3 cannot be opened by earlier versions.
Stories per day · 30 days
1 RSS
Relatedcommand-execution2exasol2api1backup1cisco1cve1data-loss1default-credentials1docker1eventsourcingdb1exploit-db1expressway1grist1jepsen1marklogic1nearest-match1orkes1particledb1
20 stories, newest first · one card per story
Stories tagged #database
Grist adds window functions for running totals in spreadsheets
Grist introduces PREVIOUS() and NEXT() functions to compute running balances and nearest matches that survive row insertions or deletions.
Jepsen finds data loss and isolation failures in ParticleDB
Tests from 1.1.4 through 1.1.18.11.rc-22 found 96 issues; default occ mode still lost committed writes.
1
Cisco Expressway flaw allows unauthenticated remote root commands
An attacker who has the persistent cookies can reach the database service and run RPC commands as root.
Exasol Database 7.1.30 remote command-execution exploit published
Exploit-DB lists a remote command-execution exploit for version 7.1.30, with no CVE or fix named.
Exasol Database 7.1.30 docker-db default SYS credential enables command execution
The docker-db image ships a default SYS credential that reaches os.popen through a PYTHON3 UDF.
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Progress fixed 31 MarkLogic Server flaws, including critical bugs that can give delegated managers persistent admin control.
3
QCATS: Query Context-Aware Transformer Slicing for Efficient Predictive Query Processing
QCATS slices transformer FFNs using query predicates, cutting in-database inference latency up to 4.42x.
CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
CVE-2026-88816: Perl DBI before 1.654 treats numeric FetchHashKeyName values as strings.
Oracle Corporation security advisory (AV26-929)
CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.
Oracle Critical Security Patch Update, September 2026 Review
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
1
CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution
Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.
CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.
CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access
Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.
MongoDB security advisory (AV26-918)
Canadian Cyber Centre advisory AV26-918 urges patching MongoDB Server vulnerability fixed in 7.0.43, 8.0.32, 8.3.11, and 9.0.1.
UCQ Leak, Israeli GlobalProtect Access, Digital Nirvana Dump, 32baar, and Ghorer Bazar
SOCRadar flags underground posts selling an alleged Universidad Cuauhtémoc database, Israeli GlobalProtect VPN access, and Digital Nirvana data dumps.
Akamai BloghighPLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
Guardicore Labs uncovers the PLEASE_READ_ME ransomware campaign targeting MySQL servers, using double extortion and publishing stolen victim data.
USN-8735-1: HSQLDB vulnerability
Ubuntu released USN-8735-1 fixing an HSQLDB flaw that lets specially crafted database files overwrite arbitrary files.
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
3
CISA Warns of Microsoft SQL Server RCE Vulnerability Exploited in Attacks
CISA warns attackers are exploiting CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to run malicious commands on database servers.
1