Citrix and Ivanti patch 19 flaws, including critical RCE bugs
Ivanti reports no evidence of exploitation; CSA 5.0.8.1 and Endpoint Manager 2024 SU8 fix the two critical defects.
Stories per day · 30 days
14 RSS
Relatedfortinet8velocloud8arista7oracle7e-business-suite6wordpress6sd-wan5cwe-894fortianalyzer4fortimanager4rce4remote-code-execution4zero-day4advisory3apache3fortimail3ics3ivanti3
153 stories, newest first · one card per story
Stories tagged #sql-injection
Ivanti patches unauthenticated SQL injection RCE in Endpoint Manager
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
1
Unauthenticated FortiMail SQL injection can execute code or commands
Fortinet rates the FortiMail flaw CVSS 9.4 and says crafted requests are enough, with no login required.
SQL injection in FortiAnalyzer and FortiManager allows authenticated code execution
The CVSS 8.8 flaw also covers both Cloud products and is triggered by crafted JSON-RPC requests.
CISA warns of two CVSS 9.0 flaws in PowerSYSTEM Center
Authenticated adjacent-network bugs allow admin-resource access or SQL commands; CISA says they are not remotely exploitable.
1
Taiwan attacker used AI agents to take Taipei dispatch records
Acronis says abliterated local models did the attacks after commercial models mostly refused, and about 10 targets were breached.
Philips Hue Bridge Pro SQL injection allows remote code execution
Network-adjacent attackers can bypass required authentication; ZDI rates CVE-2026-118632 at CVSS 8.0.
Cisco and WatchGuard release patches; SonicWall leaves GMS unpatched
SonicWall will not patch two critical flaws in its end-of-life Global Management System.
1
SQL::Abstract and SQL::Abstract::Tree before 2.000001_04 for Perl allow SQL injection and XSS (CVE-2026-121007,…
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
ADOdb vulnerability fixed in Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS (USN-7530-2)
USN-7530-2 provides updates for the ADOdb vulnerability in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
SonicWall warns of unpatched flaws in end-of-life GMS software
Two flaws in SonicWall GMS 9.5.2 and earlier allow file reads and SQL injection but will not be patched as the product reaches end of life.
PowerSYSTEM Center flaws allow SQL injection and admin resource access
Both CVEs score 9.0; Subnet tells 2020 users to install Update 30 and later lines to install 2026 Update 1.1.
1
Apache Syncope SQL injection via unsanitized opEvent
Incomplete fix for CVE-2026-77051 allows arbitrary SQL execution as administrator.
Apache Fineract through 1.15.0 has SQL injection in ORDER BY (CVE-2026-65874)
Caller-supplied orderBy, sortOrder and related parameters are concatenated on Center and datatable read APIs.
Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
1
Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
2
Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
2
Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
1
Adobe patches eight critical Campaign Classic flaws and a Connect bug
Campaign Classic through 7.4.4 build 9402 is fixed in build 9403; Adobe reports no known exploits.
1
Exploratory probes hit patched Oracle EBS RCE CVE-2026-101767
Defused saw unauthenticated SQL-injection attempts against EBS decoys on October 27; customer breaches are not confirmed.
Attackers probe newly patched critical Oracle EBS flaw
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
1
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
CISA adds exploited Collabora Online and VeloCloud flaws to KEV
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.