database security

CVE-2026-23906: Authentication Bypass Flaw Hits Apache Druid Analytics Clusters

• Vulnerability News

CVE-2026-23906: Authentication Bypass Flaw Hits Apache Druid Analytics Clusters

Do Son February 11, 2026 0

Critical Apache Druid flaw (CVE-2026-23906) allows login with no password via LDAP anonymous binds. Update to v36.0.0 or disable anonymous binds now.

Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases

• Vulnerability News

Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases

Do Son February 10, 2026 0

SAP Feb 2026 update fixes critical CVE-2026-0488 (CVSS 9.9). Code injection in CRM & S/4HANA allows full database compromise. Patch immediately.

CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens

• Vulnerability News

CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens

Do Son February 10, 2026 0

Critical Payload CMS flaw CVE-2026-25544 (CVSS 9.8) allows SQL injection via JSON fields. Unauthenticated attackers can steal admin tokens. Update to v3.73.0.

CISA Alert: MongoBleed Added to KEV Catalog as 80,000+ Servers Face Active Exploitation

• Vulnerability News

CISA Alert: MongoBleed Added to KEV Catalog as 80,000+ Servers Face Active Exploitation

Do Son December 30, 2025 0

CISA adds MongoBleed (CVE-2025-14847) to its KEV Catalog after confirming active exploitation. 80,000+ MongoDB servers are at risk. Patch by Jan 19!

PoC Released: MongoBleed Exploit Allows Unauthenticated Attackers to Drain MongoDB Memory

• Vulnerability News

PoC Released: MongoBleed Exploit Allows Unauthenticated Attackers to Drain MongoDB Memory

Do Son December 29, 2025 0

MongoBleed (CVE-2025-14847) allows unauthenticated MongoDB memory leaks. With Joe Desimone's PoC released, upgrade to v8.0.17 or v7.0.28 now!

Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression

• Vulnerability News

Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression

Do Son December 23, 2025 0

MongoDB CVE-2025-14847: A high-severity flaw in zlib compression allows unauthenticated attackers to read sensitive heap memory. Upgrade to v8.2.3+!

The Database Was the Door: A Ransomware Attack Began with an Exposed Oracle Serve

• Cybercriminals

The Database Was the Door: A Ransomware Attack Began with an Exposed Oracle Serve

Do Son September 22, 2025 0

A new report reveals that an exposed Oracle Database was the entry point for a ransomware attack. Hackers used a scheduler function to gain access and deploy malware.

MySQL Servers Under Attack: Threat Actors Exploiting UDFs to Inject Gh0stRAT, XWorm & Zoho Agents

• Cybercriminals

MySQL Servers Under Attack: Threat Actors Exploiting UDFs to Inject Gh0stRAT, XWorm & Zoho Agents

Do Son June 19, 2025 0

Threat actors are actively compromising poorly managed MySQL servers, using UDFs to inject Gh0stRAT, XWorm, HpLoader, and legitimate Zoho agents for full system control and data theft.

Flaw in PostgreSQL JDBC Driver (CVE-2025-49146) Exposes Database Connections to MITM Attacks!

• Vulnerability News

Flaw in PostgreSQL JDBC Driver (CVE-2025-49146) Exposes Database Connections to MITM Attacks!

Do Son June 13, 2025 0

A flaw (CVE-2025-49146) in PostgreSQL JDBC Driver allows MITM attacks even with channel binding enabled. Upgrade to v42.7.7 or use sslMode=verify-full.

Stealthy Data Theft: Hackers Use Legitimate DB Client Tools for Exfiltration

• Cybercriminals

Stealthy Data Theft: Hackers Use Legitimate DB Client Tools for Exfiltration

Do Son May 25, 2025 0

Threat actors are installing legitimate DB client tools like DBeaver and Navicat on compromised systems to covertly steal sensitive database information.

Pgpool-II Hit by Critical CVE-2025-46801: CVSS 9.8 Risk Lets Attackers Bypass Authentication

• Vulnerability

Pgpool-II Hit by Critical CVE-2025-46801: CVSS 9.8 Risk Lets Attackers Bypass Authentication

Do Son May 16, 2025 0

CVE-2025-46801 in Pgpool-II scores 9.8 CVSS—flaw lets attackers log in as any user. Patch now to prevent database tampering and access.

Critical Misconfiguration in Bitnami Pgpool Enables Unauthenticated PostgreSQL Access (CVE-2025-22248)

• Vulnerability

Critical Misconfiguration in Bitnami Pgpool Enables Unauthenticated PostgreSQL Access (CVE-2025-22248)

Do Son May 14, 2025 0

Bitnami Pgpool flaw (CVE-2025-22248) exposes PostgreSQL to unauthenticated access. Update to Pgpool 4.6.0-1 or Helm chart 16.0.0 to fix.

Critical SQL Injection Vulnerability Found in ADOdb PHP Library – CVE-2025-46337 (CVSS 10.0)

• Vulnerability

Critical SQL Injection Vulnerability Found in ADOdb PHP Library – CVE-2025-46337 (CVSS 10.0)

Do Son May 5, 2025 0

CVE-2025-46337 is a critical SQL injection flaw in ADOdb's PostgreSQL driver. Patch to version 5.22.9 or sanitize input to avoid exploitation.

CVE-2025-46619: LFI Vulnerability Affects Multiple Versions of Couchbase Server for Windows

• Vulnerability

CVE-2025-46619: LFI Vulnerability Affects Multiple Versions of Couchbase Server for Windows

Do Son May 2, 2025 0

Couchbase Server for Windows hit by LFI flaw CVE-2025-46619 (CVSS 8.7). Upgrade to 7.6.4 or 7.2.7 to prevent unauthorized file access.