sqlparse 0.6.1 fixes two flaws as maintainers end the project
A GitHub discussion says a flood of security reports influenced the decision to end sqlparse after this release.
Stories per day · 30 days
1 RSS
Relatedaccess-control1apache1apache-kylin1attention1cve-2026-685721cve-2026-690801end-of-life1flashattention1injection1kernels1kylin1oss-security1perl1python1spark1sqlparse1vulnerability1
12 stories, newest first · one card per story
Stories tagged #sql
SQL::Abstract before 2.000003 allows SQL injection via arrayref (CVE-2026-121265)
Passing an arrayref column value in insert and update statements enables SQL injection in SQL::Abstract before 2.000003.
Show HN derives a FlashAttention kernel from about 25 lines of SQL
The Hacker News feed only shows the title, 20 points, and one comment.
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env
Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.
Filter, reshape, and redact logs before export with Transformers
Cloudflare Logpush Transformers, now generally available, filter, redact, and reshape logs with SQL before export.
5
8 major updates to Cloudflare Observability
Cloudflare combined logs, traces, SQL queries, alerts, and dashboards into one observability platform with new pricing.
10
16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
A 16-year-old researcher bypassed unsigned JWT checks on Microsoft Titan and gained admin SQL access to analytics databases estimated at 17.3 trillion rows.
CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
Perl DBI before 1.654 treats numeric values as strings in sql_type_cast_svpv.
CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution
Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.
IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications
IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.
How a Real Estate Company Turned a SQL Lockout Into Actionable Security Insight
A real estate company used Horizon3.ai's NodeZero to trace a SQL account lockout to a hidden privilege path and remediate it.