Skip to content
Threat Feed
Subscribe

Tag

Database-Security

8 briefs RSS
critical advisory

SQL Injection in Marten LINQ Provider via Unescaped Literals

Marten versions 7.0.0 through 9.12.0 contain critical SQL injection vulnerabilities in the LINQ provider and tenant-management internals, allowing attackers to perform unauthorized data access, multi-tenant bypass, and data modification via crafted dictionary keys or tenant IDs.

Marten sql-injection cve-2026-75513 dotnet database-security
2t 1c
high advisory

Stack-Based Buffer Overflow in IBM Db2 DRDA Client Implementation

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 are vulnerable to a stack-based buffer overflow via malicious DRDA server responses, potentially leading to arbitrary command execution on clients.

Db2 vulnerability cve remote-code-execution denial-of-service database-security
2t 1c
high advisory

Authorization Bypass in IBM i DDM Target Dispatcher

A vulnerability in the IBM i DDM target dispatcher allows remote attackers to manipulate database transactions due to improper authorization handling.

IBM i vulnerability database-security
1c
high advisory

Missing Authorization Vulnerability in ArcadeDB DELETE FUNCTION Statement

ArcadeDB versions 26.7.3 and earlier are vulnerable to a missing authorization flaw allowing any authenticated database user to delete server-side functions via the command API.

ArcadeDB +2 vulnerability privilege-escalation database-security remote-code-execution
1r 3t 1c updated
critical advisory

Authentication Bypass and Privilege Escalation in ArcadeDB

ArcadeDB versions before 26.8.1 contain a vulnerability in the gRPC transaction executor that allows authenticated readers to execute arbitrary JavaScript, leading to server-wide privilege escalation.

ArcadeDB privilege-escalation database-security cve-2026-75843 vulnerability authentication-bypass arbitrary-file-read sandbox-bypass cve-2026-75840 +3
1r 5t 1c
high advisory

NoSQL Injection in Budibase Server

Budibase Server versions before 3.40.0 contain a NoSQL injection vulnerability in the MongoDB query execution endpoint, enabling authenticated attackers to bypass filters and perform unauthorized database operations.

Budibase Server web-vulnerability nosql-injection database-security
1t 1c
high advisory

Remote Code Execution in IBM Informix via sq_sgkprepare

A critical buffer-related vulnerability (CVE-2026-13361) in IBM Informix allows remote, unauthenticated attackers to achieve code execution via the SQL interface by exploiting an unchecked length field in the oninit process.

Informix remote-code-execution vulnerability database-security
2t 1c
high advisory

ArcadeDB Privilege Escalation via JavaScript Triggers

ArcadeDB versions before 26.7.3 insecurely expose the LocalDatabase object to JavaScript triggers, allowing attackers with schema update permissions to perform unauthorized administrative actions.

ArcadeDB +1 information-disclosure privilege-escalation database authentication-bypass database-security cve-2026-68578
1r 3t 1c