The highest-severity item in this feed is CVE-2026-104457 (CVSS 8.6 HIGH) in YesWiki, an unauthenticated SQL injection in the Bazar filtertags action that can leak arbitrary table data including password hashes on default installs. Important context for DB admins: the majority of the MySQL-grouped entries below are vulnerabilities in applications connecting to MySQL (YesWiki, appointment booking, LMS, drug recommendation systems), not vulnerabilities in the MySQL database engine itself; no MySQL server binary patch is required for these. In a healthcare environment, the patient-facing applications (appointment booking, drug recommendation) are the highest risk due to potential PHI exposure via SQLi. No entries in the provided feed are marked as CISA KEV-confirmed, so ranking is based on CVSS severity and exploit availability.
Formal Vulnerabilities
MySQLCVE-2026-104457CVSS 8.6 · HIGH
Summary: YesWiki before 4.6.7 contains an SQL injection in the Bazar filtertags action, which wraps unescaped `filterN` attribute tokens in quotes and concatenates them into a raw `tags.value IN (...)` clause. Unauthenticated attackers on default installs can save filtertags markup with a trailing-backslash token to break quote parity under MySQL backslash escaping, enabling a five-column UNION subquery to read arbitrary table data such as password hashes.
Affected Features / Interoperability: YesWiki Bazar filtertags action / page markup parsing. Downstream impact includes credential theft (password hashes) and arbitrary data read from the connected MySQL database; does not affect the MySQL server binary or replication.
Workaround: Disable the Bazar filtertags action or restrict page-editing privileges to authenticated administrators until patched.
Tradeoff: Disabling filtertags degrades page tagging/filtering functionality for end users.
MySQLCVE-2026-105387CVSS 7.3 · HIGH
Summary: Online-Appointment-Booking-System (up to commit f427b47) has an SQL injection in the `mysqli_query` function of `cover.php` (Patient Login Handler) via the `uname`/`psw` arguments. Remote exploitation is possible and the exploit has been released to the public.
Affected Features / Interoperability: Patient Login Handler component. Downstream impact includes unauthorized access to patient appointment data and credentials stored in the connected database; does not affect the MySQL server binary.
Fix: Version details for affected or updated releases are not available (rolling release model); the project has not responded to the issue report.
Workaround: Enforce strict input validation and parameterized queries at the application layer; restrict network access to the login endpoint.
Tradeoff: Application code changes are required; network restrictions may impact legitimate patient access.
MySQLCVE-2026-105470CVSS 7.3 · HIGH
Summary: Online-Appointment-Booking-System (up to commit f427b47) has an SQL injection in the `mysqli_query` function of `locateus.php` (Doctor Search Endpoint) via the `doctorname` argument. Remote exploitation is possible and the exploit is publicly available.
Affected Features / Interoperability: Doctor Search Endpoint component. Downstream impact includes unauthorized data read from the doctor/patient database; does not affect the MySQL server binary.
Fix: Version details for affected or updated releases are not available (rolling release model); the project has not responded to the issue report.
Workaround: Enforce strict input validation and parameterized queries at the application layer for the `doctorname` argument.
Tradeoff: Application code changes are required; strict validation may break legitimate search queries with special characters.
MySQLCVE-2026-105918CVSS 7.3 · HIGH
Summary: Kusalkasilva Learning-Management-System (up to commit ffeb873) has an SQL injection in the `mysql_error` function of `login.php` (Login Endpoint) via the `username`/`password` arguments. Remote exploitation is possible and the exploit has been disclosed to the public.
Affected Features / Interoperability: Login Endpoint component. Downstream impact includes unauthorized authentication and data read from the connected database; does not affect the MySQL server binary.
Fix: No version details of affected or updated releases are available (rolling release model); the project has not responded to the issue report.
Workaround: Enforce parameterized queries at the application layer and restrict login endpoint exposure.
Tradeoff: Application code changes are required; network restrictions may impact legitimate user access.
MySQLCVE-2026-105919CVSS 7.3 · HIGH
Summary: Kusalkasilva Learning-Management-System (up to commit ffeb873) has an SQL injection in the `mysql_query` function of `admin/login.php` (Administrator Login Endpoint) via the `username`/`password` arguments. Remote exploitation is possible and the exploit has been made public.
Affected Features / Interoperability: Administrator Login Endpoint component. Downstream impact includes administrative database access and privilege escalation; does not affect the MySQL server binary.
Fix: No version details of affected or unaffected releases are available (no versioning); the project has not responded to the issue report.
Workaround: Enforce parameterized queries at the application layer and restrict admin login endpoint exposure.
Tradeoff: Application code changes are required; network restrictions may impact legitimate admin access.
MySQLCVE-2026-105178CVSS 4.7 · MEDIUM
Summary: SourceCodester Drug Recommendation System 1.0 has an SQL injection in the `mysqli_real_escape_string` function of `/Admin/add_symptom.php` (Symptom Creation) via the `txtname` argument. Remote exploitation is possible and the exploit has been released to the public.
Affected Features / Interoperability: Symptom Creation admin component. Downstream impact includes unauthorized modification or read of symptom/drug recommendation data; does not affect the MySQL server binary.
Fix: No patched version details available in the advisory.
Workaround: Enforce strict input validation on the `txtname` argument and restrict admin access.
Tradeoff: Input validation may break legitimate symptom names containing special characters.
MySQL — CVE-2026-43917 (CVSS UNSCORED severity not provided)
Summary: Dokploy (0.19.0 and earlier) is a self-hostable PaaS where the `protectedProcedure` middleware verifies authentication but does NOT enforce organization scoping. Each endpoint must individually verify the resource's org matches the session's `activeOrganizationId`. Affected endpoints include deployment, rollback, backup, volume-backup, cluster, and mount operations across Postgres, MariaDB, MySQL, Mongo, and Compose services.
Affected Features / Interoperability: Dokploy organization scoping / multi-tenancy. Downstream impact includes cross-organization data access and resource manipulation (e.g., backups, deployments, cluster nodes) for any authenticated user; relevant if Dokploy is used to host the homelab or production DB instances.
Fix: Upgrade Dokploy to a version later than 0.19.0.
Workaround: Manually verify org scoping logic in the affected endpoints (`deployment.ts`, `backup.ts`, `cluster.ts`, etc.) if upgrading is not immediately possible.
Tradeoff: Manual verification of org scoping is error-prone and adds operational overhead.
MongoDBCVE-2026-81521CVSS 6.5 · MEDIUM
Summary: The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before building the target namespace. An application passing untrusted input as a database name could have the write directed at an unintended database and collection. Only the `Client.BulkWrite` API is affected.
Affected Features / Interoperability: MongoDB Go Driver (`go.mongodb.org/mongo-driver/v2`) `Client.BulkWrite` API. Downstream impact includes writes to unintended databases/collections, potentially corrupting data or leaking data across tenants; relevant to Go-based cloud services and homelab tooling.
Fix: Upgrade the MongoDB Go Driver to v2.8.2 or later.
Workaround: Validate and sanitize database names client-side before passing them to `Client.BulkWrite`.
Tradeoff: Client-side validation adds complexity and must be maintained across all code paths using bulk writes.
MongoDB — CVE-2026-106119 (CVSS UNSCORED severity not provided)
Summary: LangChain prior to 1.3.1 does not enforce the documented string type for an untrusted structured session identifier in `MongoDBChatMessageHistory`, allowing the identifier to be interpreted as a MongoDB query condition rather than a literal value. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation in a shared MongoDB collection. Fixed in version 1.3.1.
Affected Features / Interoperability: LangChain `MongoDBChatMessageHistory` component. Downstream impact includes cross-user conversation leakage or tampering in LLM applications sharing a MongoDB collection; does not affect the MongoDB server binary.
The most urgent cloud security issue is the critical command injection vulnerability in Dokploy (CVE-2026-45663, CVSS 9.9), which allows authenticated users to execute arbitrary OS commands on the host via unsanitized file upload parameters, posing an immediate risk of host compromise.
Formal Vulnerabilities
KubernetesCVE-2026-105985CVSS 8.8 · HIGH
Summary: Craft CMS 5.10.13.2 contains an authenticated remote code execution flaw in the Control Panel action `app/render-components`. Any authenticated user with basic Control Panel access can override an EntryType’s `uiLabelFormat` and render an Entry to execute arbitrary Twig, leading to OS command execution via PHP functions like `system()`.
Affected Features / Interoperability: The Craft CMS Control Panel `app/render-components` endpoint is impacted; downstream effects could include compromise of any system running Craft CMS and its integrations.
Workaround: Restrict Control Panel access to trusted users and consider disabling the `app/render-components` endpoint if not needed.
Tradeoff: Loss of specific Control Panel functionality may affect legitimate workflows.
KubernetesCVE-2026-33226CVSS 8.7 · HIGH
Summary: Budibase versions ≤3.30.6 lack validation on the REST datasource query preview endpoint (`POST /api/queries/preview`), allowing an authenticated admin to trigger server-side HTTP requests to arbitrary URLs, including internal cloud metadata endpoints and Kubernetes APIs.
Affected Features / Interoperability: The Budibase REST datasource preview endpoint is affected; abuse can lead to internal network enumeration and theft of GCP OAuth2 tokens with full cloud-platform scope.
Fix: No publicly available patch at time of publication.
Workaround: Restrict admin access to the preview endpoint, disable it if unnecessary, and enforce network segmentation to block outbound HTTP requests from Budibase.
Tradeoff: Loss of datasource preview functionality may hinder legitimate troubleshooting.
KubernetesCVE-2026-26287CVSS 7.1 · HIGH
Summary: External Secrets Operator versions 0.10.0 through 1.3.1 have a webhook generator initialization bug that clears the label-enforcement flag after it is set, allowing secrets without the required `external-secrets.io/type=webhook` label to be created.
Affected Features / Interoperability: The External Secrets Operator webhook generator is impacted; this could bypass label enforcement policies and lead to unintended secret exposure.
Fix: Upgrade to External Secrets Operator version 1.3.2 or later.
Workaround: Enforce label requirements via alternative admission controllers or policy engines and avoid using the webhook generator until patched.
Tradeoff: May lose webhook-based secret automation capabilities.
KubernetesCVE-2026-32598CVSS 6.5 · MEDIUM
Summary: OneUptime versions prior to 10.0.24 log the complete password reset URL (including the plaintext token) at INFO level, enabling anyone with access to application logs to intercept tokens and hijack accounts.
Affected Features / Interoperability: The OneUptime password reset flow logging mechanism is affected; exposure could lead to account takeover across any integrated service.
Workaround: Restrict log access, disable INFO-level logging for password reset URLs, or implement log masking to omit tokens.
Tradeoff: Reduced visibility for debugging authentication flows.
KubernetesCVE-2026-93537CVSS 6.5 · MEDIUM
Summary: In SUSE Rancher Fleet versions prior to 0.16.2, 0.15.7, 0.14.11, 0.13.16, and 0.12.20, a user who can supply bundle content to a GitRepo resource can cause the Fleet controller to read arbitrary files from the bundle-processing environment’s filesystem, potentially exposing credentials such as Helm registry tokens.
Affected Features / Interoperability: The Fleet GitRepo resource processing and bundle handling are impacted; leakage of configuration or secret material could affect downstream CI/CD pipelines and cluster access.