The most urgent vulnerability is a high-severity SQL injection flaw in the UTMStack (PostgreSQL) version prior to 11.2.16 (CVE-2026-82039), which allows authenticated attackers to execute arbitrary SQL queries with database administrator privileges, enabling full database read, modification, and potential filesystem access. While several other systems exhibit critical SQL injection risks—including YesWiki (CVE-2026-104457) and various components in the girishsaraf and Kusalkasilva ecosystems—the PostgreSQL flaw carries the highest CVSS score (8.8) and directly compromises database integrity and availability.
MySQL
[MySQL] — CVE-2026-104457 (CVSS 8.6 HIGH)
Summary: YesWiki versions prior to 4.6.7 suffer from an SQL injection vulnerability in the `filtertags` action where unescaped filterN attributes are concatenated into a raw tags value clause, allowing unauthenticated attackers to inject UNION subqueries and extract arbitrary table data such as password hashes.
Affected Features / Interoperability: The YesWiki application layer, specifically the `filtertags` action, enabling unauthorized data extraction from the underlying MySQL database.
Workaround: Disable the `filtertags` action or restrict access to the vulnerable endpoint.
Tradeoff: May require updating dependent frontend configurations to handle changes in tag rendering.
[MySQL] — CVE-2026-105387 (CVSS 7.3 HIGH)
Summary: The Online-Appointment-Booking-System (girishsaraf) contains a SQL injection in the `mysqli_query` function of `patient_login.php` where manipulation of the `uname` and `psw` arguments allows remote code execution via a public exploit.
Affected Features / Interoperability: The Patient Login Handler and Online Appointment Booking System, permitting remote data exfiltration.
Fix: Patch the component to version f427b4757128ca253d33d0cc4e87bbb9c999a4d5 or later.
Workaround: Implement strict input sanitization on the `uname` and `psw` parameters.
Tradeoff: Potential degradation in login form usability if complex characters are restricted.
[MySQL] — CVE-2026-105468 (CVSS 7.3 HIGH)
Summary: Similar to CVE-2026-105387, the `Admin/mlogin.php` file in the Online-Appointment-Booking-System allows SQL injection via the `uname` and `pass` arguments, enabling remote attackers to manipulate database queries.
Affected Features / Interoperability: The Login Handler and appointment booking workflow, facilitating unauthorized database reads and modifications.
Workaround: Deploy a Web Application Firewall (WAF) rule to block suspicious payload patterns.
Tradeoff: Increased operational overhead managing WAF rules across multiple instances.
[MySQL] — CVE-2026-105470 (CVSS 7.3 HIGH)
Summary: The `locateus.php` file in the Doctor Search Endpoint permits SQL injection when the `doctor_name` parameter is manipulated, allowing remote UNION-based data extraction.
Affected Features / Interoperability: The Doctor Search Endpoint and clinical scheduling integration, threatening patient data privacy.
Workaround: Whitelist allowed character sets for the doctor name input.
Tradeoff: Reduced flexibility in searching for doctors with special characters.
[MySQL] — CVE-2026-105918 (CVSS 7.3 HIGH)
Summary: The Kusalkasilva Learning-Management-System (login.php) has a SQL injection in the `mysql_error` function where the `username` and `password` parameters are improperly validated, allowing remote data manipulation.
Affected Features / Interoperability: The Login Endpoint and administrative access controls.
Fix: Patch the system to version ffeb873f8803f1e9664384ff75000c7da45466d2.
Workaround: Enforce principle of least privilege on the login database user.
Tradeoff: Possible disruption during the patching window.
[MySQL] — CVE-2026-105919 (CVSS 7.3 HIGH)
Summary: The `admin/login.php` file in the Kusalkasilva system suffers from SQL injection via the `mysql_query` function, allowing remote attackers to execute arbitrary queries against the database.
Affected Features / Interoperability: The Administrator Login Endpoint and system administration interfaces.
Workaround: Monitor database audit logs for anomalous activity.
Tradeoff: None, aside from requiring a coordinated deployment.
[MySQL] — CVE-2026-105178 (CVSS 4.7 MEDIUM)
Summary: The SourceCodester Drug Recommendation System (add_symptom.php
Cloud Security
The most urgent item is not a CISA KEV-confirmed exploit, but a Critical severity vulnerability in Microsoft Azure API Management (CVE-2025-66390) that allows cross-tenant signup bypass. Among the analyzed systems, the highest severity threats involve Kubernetes components (CVE-2026-101919, CVE-2026-105985) and critical Docker tooling (CVE-2025-69201, CVE-2026-105641).
Formal Vulnerabilities
Microsoft Azure
CVE-2025-66390 (CVSS 9.8 CRITICAL)
Summary: In Microsoft Azure API Management through 2025-10-17, enabling self-service signup with username/password Basic Authentication allows attackers to reuse the registration flow by altering the hostname or tenant identifier to create new tenants (Tenant B) even when signup is disabled at the UI level, bypassing intended tenant isolation.
Affected Features / Interoperability: Azure API Management self-service signup flow and tenant isolation boundaries.
Fix: Apply official patched version (supplier evaluated but notes configuration issue).
Workaround: Disable self-service signup in the UI layer (note: supplier indicates this may not fully resolve the underlying API endpoint vulnerability).
Tradeoff: No significant tradeoff expected if the correct configuration is applied.
Kubernetes
CVE-2026-101919 (CVSS 8.8 HIGH)
Summary: The HyperShift operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without validation, allowing an authenticated user with cluster and secret creation permissions to supply malicious configuration and achieve arbitrary code execution in the control plane.
Affected Features / Interoperability: HyperShift operator, Kubernetes control plane namespace.
Fix: Update HyperShift operator to version 1.3.2+.
Workaround: Restrict kubeconfig sharing and validate secrets before ingestion.
Tradeoff: Potential disruption to existing cluster configurations relying on the operator's automatic secret copying.
CVE-2026-105985 (CVSS 8.8 HIGH)
Summary: Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components, allowing attackers to forge Twig template overrides to evaluate arbitrary Twig strings via renderObjectTemplate(), leading to OS command execution.
Affected Features / Interoperability: Craft CMS Control Panel (render-components), Twig template engine.
Fix: Upgrade Craft CMS to version 5.11.0 or later.
Workaround: Disable the Control Panel action app for non-administrative users.
Tradeoff: Loss of dynamic component rendering capabilities in the Control Panel.
CVE-2026-105223 (CVSS 7.4 HIGH)
Summary: maccloft kubernetes-client version 0.17.0 before 0.32.0 disables TLS certificate verification when a kubeconfig lacks certificate-authority-data, allowing on-path attackers to impersonate the Kubernetes API server and steal credentials.
Affected Features / Interoperability: kubernetes-client library, TLS handshake integrity.
Fix: Upgrade kubernetes-client to version 0.32.0+.
Workaround: Enforce strict mTLS and verify CA certificates manually.
Tradeoff: Requires redeployment of affected clusters.
CVE-2026-26287 (CVSS 7.1 HIGH)
Summary: External Secrets Operator incorrectly clears the EnforceLabels flag during webhook generation initialization, skipping provider-side checks for external-secrets.io resources and allowing invalid secret types to be accepted.
Affected Features / Interoperability: External Secrets Operator webhook generation and label enforcement.
Fix: Upgrade External Secrets Operator to version 1.3.2+.
Workaround: Manually audit external secrets and enforce label compliance.
Tradeoff: Temporary loss of automated secret validation.
CVE-2026-103546 (CVSS 4.3 MEDIUM)
Summary: Insufficient validation of Ops Manager backup configuration in MongoDB Controllers may allow modification of custom resources to induce unintended administrative changes in Ops Manager.
Affected Features / Interoperability: MongoDB Kubernetes Ops Manager backup reconciliation.
Summary: Eclipse Che versions 7.29.0 and later allow reading arbitrary local files via the file:// scheme through an unvalidated URL parameter, potentially exposing service account tokens and SCM personal access tokens.
Affected Features / Interoperability: Eclipse Che API endpoints (`/api/scm/resolve`, `POST /api/factory/resolver`).
Workaround: Block file:// scheme access in application firewalls.
Tradeoff: None; requires application update.
Docker
CVE-2025-69201 (CVSS 9.8 CRITICAL)
Summary: Tugtainer allows arbitrary arguments to be injected into the agent's POST api/command/run endpoint, enabling command execution before container updates.
Affected Features / Interoperability: Tugtainer self-hosted automation tool.
Summary: Plane project management tool provides hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in community deployments, allowing attackers to forge Django-signed values and compromise accounts or sessions.
Affected Features / Interoperability: Plane community deployments (aio/cli).
Workaround: Rotate secrets immediately and restrict community deployment usage.
Tradeoff: Downtime during upgrade window.
CVE-2026-102282 (CVSS 7.1 HIGH)
Summary: The adm-zip library extracts binaries with incorrect Unix permission bits (setuid/setgid) when keepOriginalPermission is true, potentially creating root-executable files if run as root.
Affected Features / Interoperability: adm-zip archive extraction library.
Workaround: Disable kube-compare or run in a restricted environment.
Tradeoff: Loss of comparison functionality until patched.
CVE-2026-103433 (CVSS null)
Summary: Docker Buildx Bake does not request expected fs.read approval for certain filesystem inputs, potentially exposing sensitive files via pathless secrets.
Affected Features / Interoperability: Docker Buildx Bake manifest processing.
Workaround: Audit pathless secrets in Bake definitions.
Tradeoff: None; addresses a potential information leak.
CVE-2026-104859 (CVSS null)
Summary: Nx monorepo releases construct shell command strings that can be executed during release publishing, exposing registry credentials and cloud tokens.
Affected Features / Interoperability: Nx monorepo solution (release/publish pipelines).
Summary: Dockerfile frontend loads .dockerignore and Dockerfile content into memory without size limits, risking memory exhaustion and daemon termination.
Affected Features / Interoperability: Docker build process.
Fix: Configure Docker BuildKit to limit memory usage.
Workaround: Reduce build complexity or increase memory allocation.
Tradeoff: Performance impact if limits are too restrictive.
Terraform
CVE-2026-104994 (CVSS 2.5 LOW)
Summary: Trivy scanner allows directory traversal in filesystem functions, potentially exposing sensitive data within scan outputs when processing untrusted input.
Affected Features / Interoperability: Trivy misconf scanning functionality.