Lotus - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/lotus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 16:14:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLotus: SQL injection in billable metrics (CVE-2026-115331)https://feed.craftedsignal.io/briefs/2026-10-lotus-sql-injection-c964744e/Thu, 22 Oct 2026 16:14:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lotus-sql-injection-c964744e/Lotus versions through 0.10.2 contain an SQL injection vulnerability that allows authenticated organization users to inject SQL via billable metric property_name or categorical filter values.<p>Lotus versions through 0.10.2 contain an SQL injection vulnerability. Authenticated organization users can inject SQL by supplying crafted billable metric property_name or categorical filter values. These values are rendered unescaped into Jinja-generated counter, gauge, and rate metric queries, allowing access to the database shared by all tenants.</p> highadvisory