Daily Digest
The most urgent items this cycle are a cluster of CVSS 8.8 SQL-injection flaws affecting MySQL-backed applications (LimeSurvey RemoteControl API, Budibase column-rename DDL, and my little forum bookmark feature) and a PostgreSQL injection in OpenRemote’s crosstab export. All require authentication but allow stacked queries or data exfiltration with modest privileges. No CISA KEV entries appear in this dataset, so theoretical severity drives priority. Patch the application layers first—LimeSurvey, Budibase, OpenRemote, and my little forum—since the underlying database engines themselves only show medium-severity DoS bugs in this window.
Summary: An authenticated SQL injection in the bookmark reordering feature of my little forum (PHP/MySQL) prior to version 2.5.12 allows any logged-in user to execute arbitrary SQL commands, leading to full database compromise (read, modify, delete all data).
Affected Features / Interoperability: The bookmark reordering feature in my little forum application. Downstream impact includes complete compromise of the application’s database; no direct impact on MySQL replication, client drivers, or extensions.
Source: https://github.com/My-Little-Forum/mylittleforum/releases/tag/20251021.1, https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-m8hj-c6gr-6h6v
Actions:
Summary: LimeSurvey’s RemoteControl API methods `invite_participants` and `remind_participants` concatenate a caller-supplied token-ID array into a SQL `IN` clause without parameterization. An authenticated attacker with `tokens/update` permission on a survey can inject stacked queries (INSERT/UPDATE/DELETE/DROP/CREATE) because PDO uses emulated prepares and MySQL multi-statements are enabled. This allows reading administrator password hashes, survey PII, sessions, and settings via time-based blind oracle, and overwriting hashes or dropping tables.
Affected Features / Interoperability: LimeSurvey RemoteControl API (RPCInterface = json/xml), which is not enabled by default. Impacts any schema the application’s database user can access. No direct impact on MySQL server components.
Source: https://github.com/LimeSurvey/LimeSurvey/pull/5031, https://www.limesurvey.org/, https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection
Actions:
Summary: Budibase before 3.45.0 builds MySQL (and MSSQL) column-rename DDL by interpolating identifiers directly into raw query strings without using the project’s quoting helpers. An attacker with DDL rights on a connected datasource can create a column name containing a backtick (MySQL) or single quote (MSSQL) plus injected SQL; when a builder later renames that column via the UI, the payload executes as the datasource user. MySQL connection uses `multipleStatements: true`, enabling stacked statements.
Affected Features / Interoperability: Budibase column-rename operation (POST /api/tables with `_rename.old`). Impacts any MySQL/MSSQL datasource connected to Budibase; bypasses Budibase’s row/table permission model.
Source: https://github.com/Budibase/budibase/security/advisories/GHSA-ppj8-hmx2-m546, https://www.vulncheck.com/advisories/budibase-before-3.45.0-sql-injection-via-column-rename-ddl
Actions:
Summary: The wpForo Forum plugin for WordPress ≤ 2.4.8 is vulnerable to error-based or time-based SQL injection via the `get_members()` function due to missing integer validation on `offset` and `row_count` parameters. Unauthenticated attackers can append a `PROCEDURE ANALYSE` clause after the `LIMIT` clause (MySQL 5.x grammar) to extract database data.
Affected Features / Interoperability: wpForo Members functionality (`classes/Members.php`). No direct MySQL server impact; WordPress site database exposure.
Source: https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/classes/Members.php#L1557, https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.9/classes/Members.php#L1557, https://wordpress.org/plugins/wpforo/#developers, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc406e8a-c4eb-45c3-a53c-37644e0dabfa?source=cve
Actions:
Summary: girishsaraf Online-Appointment-Booking-System (up to commit f427b47) has a SQL injection in `Admin/mlogin.php` via the `uname`/`pass` parameters passed to `mysqli_query`. The exploit is public; the project uses a rolling release with no versioned fix and has not responded to disclosure.
Affected Features / Interoperability: Login handler component. No versioned release data available; impact limited to this application’s database.
Source: https://github.com/girishsaraf/Online-Appointment-Booking-System/, https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/6, https://vuldb.com/cve/CVE-2026-105468, https://vuldb.com/submit/984333, https://vuldb.com/vuln/413614
Actions:
Summary: The Filter & Grids plugin for WordPress ≤ 3.2.0 has a SQL injection via the `phrase` parameter due to insufficient escaping and lack of query preparation. Unauthenticated attackers can extract data, but the exploit only works on MariaDB (syntax error on MySQL).
Affected Features / Interoperability: Filter & Grids plugin search functionality. MariaDB-specific; no MySQL impact per the advisory.
Source: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378420%40ymc-smart-filter&new=3378420%40ymc-smart-filter&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bbab6e-ed2f-4b90-a658-aae85906d06e?source=cve
Actions:
Summary: Oracle MySQL Server (component: Server: DML) versions 8.0.0–8.0.43, 8.4.0–8.4.6, 9.0.0–9.4.0. Easily exploitable by a high-privileged network attacker to cause a hang or repeatable crash (DoS) and unauthorized update/insert/delete of some accessible data.
Affected Features / Interoperability: MySQL Server DML subsystem. Impacts data integrity and availability; no replication or client-driver specifics mentioned.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle MySQL Server (component: InnoDB) versions 8.0.0–8.0.43, 8.4.0–8.4.6, 9.0.0–9.4.0. High-privileged network attacker can cause DoS and unauthorized update/insert/delete of some accessible data.
Affected Features / Interoperability: InnoDB storage engine. Same scope as above.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle MySQL Server (component: Server: Optimizer) versions 8.0.0–8.0.43, 8.4.0–8.4.6, 9.0.0–9.4.0. High-privileged network attacker can cause a hang or repeatable crash (DoS only).
Affected Features / Interoperability: Query optimizer. Availability impact only.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle MySQL Server (component: Server: Optimizer) versions 8.0.0–8.0.43, 8.4.0–8.4.6, 9.0.0–9.4.0. High-privileged network attacker can cause a hang or repeatable crash (DoS only).
Affected Features / Interoperability: Query optimizer. Availability impact only.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: OpenRemote before 1.26.0 has an authenticated SQL injection in the datapoint crosstab export endpoint. Asset display names are concatenated into raw PostgreSQL queries. An authenticated attacker with asset creation/rename permissions can inject SQL via the asset name and receive results in the exported CSV, enabling data exfiltration.
Affected Features / Interoperability: OpenRemote crosstab export endpoint. Impacts PostgreSQL data accessible to the application user; no direct PostgreSQL server component impact.
Source: https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v, https://www.vulncheck.com/advisories/openremote-sql-injection-via-crosstab-export
Actions:
Summary: The External Login plugin for WordPress ≤ 1.11.2 has a SQL injection via the `log` parameter due to insufficient escaping and lack of query preparation. Unauthenticated attackers can extract data when PostgreSQL (or MSSQL) is configured as the external authentication database.
Affected Features / Interoperability: External Login plugin’s authentication flow (`login/db.php`). Only relevant when PostgreSQL/MSSQL is the external auth backend.
Source: https://plugins.trac.wordpress.org/browser/external-login/tags/1.11.2/login/db.php#L153, https://www.wordfence.com/threat-intel/vulnerabilities/id/488f1a2f-01c8-40cf-b52f-d707271105f5?source=cve
Actions:
Summary: pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11–42.7.13: when `requireAuth` connection property excludes all six known auth methods (e.g., `requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none` or `requireAuth=,`), the driver accepts any server-requested method, including cleartext password. A MitM attacker can steal the database password.
Affected Features / Interoperability: JDBC driver authentication negotiation. Applications using affected driver versions with exclusion-only `requireAuth` values.
Source: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
Actions:
Summary: pgjdbc versions 42.7.4–42.7.13 pad short values with leftover send-buffer bytes (up to 8192 bytes, 16320 with GSS) instead of zeros. The padding contains prior SQL text and parameter values from the same pooled connection. An attacker who can store and read back such a value can collect earlier traffic.
Affected Features / Interoperability: PreparedStatement.setObject with ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, Blob.setBytes when declared length exceeds supplied data. Connection pooling amplifies cross-request leakage.
Source: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3
Actions:
Summary: pgjdbc versions 42.7.4 and 42.7.5 on GSS-encrypted connections (`gssEncMode=prefer` or `require`) can send previous GSS send-buffer contents (up to 16320 bytes) as the first part of a value. The stored value contains prior SQL text, parameters, or batch rows. Most such writes fail with `ArrayIndexOutOfBoundsException`. Default `gssEncMode=allow` is not affected.
Affected Features / Interoperability: GSS-encrypted connections with specific bind-parameter APIs (setString, setBytes, ByteStreamWriter, CopyIn, LargeObject.write). Only versions 42.7.4–42.7.5.
Source: https://github.com/pgjdbc/pgjdbc/commit/96f6862bb6bcadde7620688c7bce73f2d01a7ebb, https://github.com/pgjdbc/pgjdbc/pull/3500, https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hggc-j2qh-988m
Actions:
Summary: Same LimeSurvey RemoteControl API SQL injection as listed under MySQL (CVE-2026-50636). The advisory notes MySQL multi-statements; Oracle Database impact would depend on whether LimeSurvey is configured with an Oracle backend and whether stacked queries are supported. The raw data does not specify Oracle-specific behavior.
Affected Features / Interoperability: LimeSurvey RemoteControl API. Downstream Oracle impact not detailed in the provided data.
Source: https://github.com/LimeSurvey/LimeSurvey/pull/5031, https://www.limesurvey.org/, https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection
Actions:
Summary: Oracle Database Server Java VM component versions 19.3–19.28, 21.3–21.19, 23.4–23.9. Difficult-to-exploit unauthenticated network attacker via Oracle Net can compromise Java VM, leading to unauthorized creation/deletion/modification of critical or all Java VM accessible data.
Affected Features / Interoperability: Java VM inside Oracle Database. No specifics on downstream PL/SQL, replication, or application integrations provided.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle Database Server Portable Clusterware component versions 19.3–19.28, 21.3–21.19, 23.4–23.9. Easily exploitable unauthenticated attacker via Bonjour can compromise Portable Clusterware, with scope change impacting additional products. Results in unauthorized read access to a subset of Portable Clusterware data.
Affected Features / Interoperability: Portable Clusterware (Bonjour/mDNS). Scope change noted; specific downstream products not listed.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle Database Server RDBMS Functional Index component version 23.4–23.9. Easily exploitable by high-privileged attacker with SYSDBA via Oracle Net. Unauthorized read access to a subset of Functional Index data.
Affected Features / Interoperability: Functional Index feature in 23c. Requires SYSDBA.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Oracle Database Server Unified Audit component version 23.4–23.9. Easily exploitable by high-privileged attacker with DBA via Oracle Net. Unauthorized update/insert/delete of some Unified Audit data.
Affected Features / Interoperability: Unified Audit in 23c. Requires DBA privilege.
Source: https://www.oracle.com/security-alerts/cpuoct2025.html
Actions:
Summary: Budibase Server before 3.40.0 has a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters. Attackers with query write permission can inject structural characters to alter queries, bypass filters, and read/modify/delete arbitrary documents.
Affected Features / Interoperability: Budibase MongoDB query execution endpoint. Bypasses Budibase’s per-user access controls.
Source: https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64, https://www.vulncheck.com/advisories/budibase-server-before-nosql-injection-via-json-parameter
Actions:
Summary: MongoDB Rust Driver versions prior to v3.2.5: when `tlsInsecure=False` appears in a connection string, certificate validation is disabled, exposing connections to MitM.
Affected Features / Interoperability: Rust driver TLS connection handling. Applications using affected driver versions with `tlsInsecure=False` in connection strings.
Source: https://jira.mongodb.org/browse/RUST-2264
Actions:
Summary: MongoDB Atlas SQL ODBC driver on Windows versions 1.0.0–2.0.0 has incorrect default permissions on installation, allowing privilege escalation.
Affected Features / Interoperability: Atlas SQL ODBC driver installer (Windows). Local privilege escalation vector.
Source: https://www.mongodb.com/docs/atlas/release-notes/sql/
Actions:
Summary: MongoDB BI Connector ODBC driver versions 1.0.0–1.4.6 has incorrect default permissions on Windows, allowing privilege escalation.
Affected Features / Interoperability: BI Connector ODBC driver installer (Windows).
Source: https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.7
Actions:
Summary: Budibase before 3.40.0 has a NoSQL injection in the MongoDB datasource integration. User-supplied parameters are enriched with Handlebars using `noEscaping: true` and parsed without operator filtering. Attackers can inject MongoDB operators (`$where`, etc.) to bypass access controls, read arbitrary documents, execute JavaScript, or modify collections.
Affected Features / Interoperability: Budibase MongoDB datasource integration. Bypasses per-user access controls.
Source: https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr, https://www.vulncheck.com/advisories/budibase-before-nosql-injection-via-mongodb-datasource
Actions:
Summary: Post-authentication flaw in MongoDB Server’s network two-phase commit protocol for cross-shard transactions (v8.0 < 8.0.16, v7.0 < 7.0.26, v8.2 < 8.2.2). Under unpredictable, short-lived conditions, transaction coordination may misinterpret a transaction as committed, causing logical data inconsistencies on affected shards. Low integrity and availability impact.
Affected Features / Interoperability: Cross-shard transactions (sharded clusters). Impacts data consistency during distributed commits.
Source: https://jira.mongodb.org/browse/SERVER-106075
Actions:
Summary: MongoDB Connector for BI installation via MSI on Windows (versions 2.0.0–2.14.24) leaves ACLs unset on custom install directories, allowing privilege escalation.
Affected Features / Interoperability: BI Connector MSI installer (Windows custom directories).
Source: https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25
Actions:
MySQL
PostgreSQL
Oracle Database
The single most urgent item this cycle is CVE-2026-26216 (Crawl4AI, CVSS 10.0 CRITICAL): an unauthenticated remote code execution flaw in the Docker API deployment's `/crawl` endpoint that allows arbitrary command execution, file access, and lateral movement; if this service is network-reachable, isolate it and upgrade to v0.8.0 immediately. Cluster-wide, three Traefik vulnerabilities (CVE-2026-85594, CVE-2026-85596, CVE-2026-88877) bypass authentication and mTLS enforcement in the Kubernetes Ingress provider, directly impacting our healthcare ingress and homelab mTLS/PKI setup. Also relevant to our environment: the Vault Terraform Provider CVE-2025-13357 changes LDAP auth defaults (affecting our Vault homelab), and runc CVE-2025-52881 requires container runtime patching across the estate.
Summary: The "Microsoft Azure Storage for WordPress" plugin (all versions up to and including 4.5.1) allows authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the `replace_attachment` parameter, exploiting missing capability checks on the `azure-storage-media-replace` AJAX action. The nonce required to trigger this is exposed to all authenticated users.
Affected Features / Interoperability: WordPress plugin integration with Azure Blob Storage; impacts media library integrity and any downstream workflows relying on stored media assets.
Source: https://plugins.trac.wordpress.org/browser/windows-azure-storage/tags/4.5.1/includes/class-windows-azure-replace-media.php#L152, https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad?source=cve
Actions:
Summary: Traefik v3.7.1 fails to enforce `crossProviderNamespaces` restrictions on the `traefik.ingress.kubernetes.io/service.middlewares` Service annotation. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service and recover injected backend credentials at a controlled backend.
Affected Features / Interoperability: Kubernetes Ingress provider middleware injection; breaks namespace isolation guarantees and tenant credential separation.
Source: https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9, https://www.vulncheck.com/advisories/traefik-3.7.1-crossprovidernamespaces-bypass-via-service-middleware
Actions:
Summary: Traefik v3.7.0–v3.7.10 contains an authentication bypass in the Kubernetes Ingress NGINX provider where two Ingress objects sharing a host, client CA secret, and client-auth mode produce distinct TLS option names, causing a conflict fallback to the entry point's default TLS config. Routes configured with `nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"` become reachable without a client certificate.
Affected Features / Interoperability: NGINX Ingress provider TLS/mTLS enforcement; breaks client certificate authentication for healthcare APIs relying on mTLS.
Source: https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq, https://www.vulncheck.com/advisories/traefik-3.7-authentication-bypass-via-tls-option-conflict
Actions:
Summary: Traefik v3.7.0–v3.7.11 mishandles Ingresses carrying both an authentication annotation and `nginx.ingress.kubernetes.io/from-to-www-redirect`, creating a sibling router that bypasses all annotation-derived middlewares including BasicAuth and source-IP allowlisting. Requests with non-numeric or empty ports select this sibling router and reach the protected backend unauthenticated.
Affected Features / Interoperability: NGINX Ingress provider redirect/authentication handling; bypasses auth and source-IP allowlisting for affected Ingresses.
Source: https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29, https://www.vulncheck.com/advisories/traefik-3.7.0-authentication-bypass-via-from-to-www-redirect
Actions:
Summary: The HyperShift operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without validation. An authenticated user with cluster and secret creation permissions can supply unauthorized executable plugins to achieve arbitrary code execution within the control plane.
Affected Features / Interoperability: HyperShift operator control plane provisioning; impacts any OpenShift on AWS deployments managed via HyperShift.
Source: https://access.redhat.com/security/cve/CVE-2026-101919, https://bugzilla.redhat.com/show_bug.cgi?id=2542541
Actions:
Summary: Traefik v3.7.0–v3.7.6 contains a namespace confusion in the Kubernetes Gateway API provider where `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` resolves against the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author with a ReferenceGrant for a cross-namespace Service can bind a Traefik Middleware from the backend namespace to inject trusted reverse-proxy identity headers.
Affected Features / Interoperability: Gateway API HTTPRoute middleware resolution; breaks namespace isolation for middleware and identity header injection.
Source: https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0, https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj
Actions:
Summary: Traefik 3.6.0–3.6.22 and 3.7.0–3.7.6 fail to enforce the `crossProviderNamespaces` allowlist for IngressRouteTCP `serversTransport` references. A low-privileged user in a non-allowlisted namespace can set `serversTransport: foo@file` to use a file-provider TCPServersTransport, gaining access to privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings.
Affected Features / Interoperability: IngressRouteTCP provider serversTransport configuration; exposes backend mTLS client certificates and SPIFFE identities to unauthorized tenants.
Source: https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0, https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv
Actions:
Summary: Omni (Kubernetes management on bare metal, VMs, or cloud) may leak sensitive information via an API in versions prior to 1.1.5 and 1.0.2.
Affected Features / Interoperability: Omni API surface; impacts any Omni-managed Kubernetes clusters.
Source: https://github.com/siderolabs/omni/security/advisories/GHSA-77r9-w39m-9xh5
Actions:
Summary: Contrast confidential-computing runtime versions before 1.18.0 are vulnerable to AML injection ("BadAML") in the guest kernel's ACPI/AML handling. An attacker controlling the host can craft malicious AML bytecode executed by the guest kernel with access to full guest memory, resulting in arbitrary code execution and disclosure of confidential guest data. Affects AMD SEV-SNP platforms (Metal-QEMU-SNP, Metal-QEMU-SNP-GPU); Intel TDX is not affected.
Affected Features / Interoperability: Confidential computing runtime (Contrast) on AMD SEV-SNP; impacts workloads relying on confidential guest isolation.
Source: https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m, https://www.vulncheck.com/advisories/contrast-before-1.18.0-aml-injection-remote-code-execution
Actions: