Monthly
Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers to achieve high confidentiality, integrity and availability impact across a scope boundary without authentication or user interaction. The affected product line, feature, protocol and version range are not stated in the available data; the only authoritative source is HPE security bulletin hpesbnw05162en_us, which must be consulted to identify the exact product and fixed build. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is tagged 'Information Disclosure' while the assessed vector also scores high integrity and availability impact, so the true impact profile should be confirmed from the vendor bulletin. Vuln.today priority is act_now based on the assessed vector.
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact against an HPE networking product, based on the supplied CVSS 3.1 vector scoring 10.0 with scope change. The CVE has no description and no published affected version range; the HPE Security Bulletin hpesbnw05162en_us is the only reference, and the exact product feature, deployment mode, and trigger remain unverified. No public exploit is identified at time of analysis.
Blind SQL injection in AmentoTech Workreap Core before 3.4.4 allows an authenticated low-privileged user to extract data from the WordPress database; the risk picture is moderate and somewhat conflicting because exploitation requires a plugin account rather than anonymous access. No public exploit was identified at time of analysis, and the specific vulnerable endpoint or parameter is not described in the supplied sources.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
SQL injection in JSON-SCADA releases before 0.65-alpha lets an authenticated user inject arbitrary SQL through the OPC historian HistoryRead API implemented by opcApi() in src/server_realtime_auth/index.js, by supplying crafted NodeId.Id, StartTime or EndTime values in a HistoryReadRequest. Because stacked statements are accepted, an attacker with any valid account can read, modify or delete historian data across all locations irrespective of their assigned role, giving high confidentiality, integrity and availability impact to the historian. Exploitation requires network reach to the HistoryRead endpoint plus valid credentials (CVSS 4.0 PR:L, aligned with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code is identified at time of analysis, the issue is not in CISA KEV, and VulnCheck reporting places remediation in the current weekly patch cycle rather than an emergency response.
SQL injection in mem0's Databricks vector store backend (mem0/vector_stores/databricks.py) affects versions 0.1.117 up to but not including 1.0.8, and lets remote unauthenticated attackers inject SQL that runs on the configured Databricks SQL warehouse by supplying crafted memory text, metadata values, or message names that reach unescaped string interpolation in the insert() and update() statements. Successful injection gives high confidentiality, integrity, and availability impact on the warehouse, though the assessed vector (AC:H/AT:P) indicates exploitation is not deterministic and requires the non-default Databricks backend to be configured; the trigger mechanics for reliably carrying a payload through mem0's ingestion pipeline are not described in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, the vendor has released the v1.0.8 fix, and the issue carries an act_now priority label with a CVSS 4.0 base score of 9.2.
Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.
Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers to achieve high confidentiality, integrity and availability impact across a scope boundary without authentication or user interaction. The affected product line, feature, protocol and version range are not stated in the available data; the only authoritative source is HPE security bulletin hpesbnw05162en_us, which must be consulted to identify the exact product and fixed build. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is tagged 'Information Disclosure' while the assessed vector also scores high integrity and availability impact, so the true impact profile should be confirmed from the vendor bulletin. Vuln.today priority is act_now based on the assessed vector.
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact against an HPE networking product, based on the supplied CVSS 3.1 vector scoring 10.0 with scope change. The CVE has no description and no published affected version range; the HPE Security Bulletin hpesbnw05162en_us is the only reference, and the exact product feature, deployment mode, and trigger remain unverified. No public exploit is identified at time of analysis.
Blind SQL injection in AmentoTech Workreap Core before 3.4.4 allows an authenticated low-privileged user to extract data from the WordPress database; the risk picture is moderate and somewhat conflicting because exploitation requires a plugin account rather than anonymous access. No public exploit was identified at time of analysis, and the specific vulnerable endpoint or parameter is not described in the supplied sources.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
SQL injection in JSON-SCADA releases before 0.65-alpha lets an authenticated user inject arbitrary SQL through the OPC historian HistoryRead API implemented by opcApi() in src/server_realtime_auth/index.js, by supplying crafted NodeId.Id, StartTime or EndTime values in a HistoryReadRequest. Because stacked statements are accepted, an attacker with any valid account can read, modify or delete historian data across all locations irrespective of their assigned role, giving high confidentiality, integrity and availability impact to the historian. Exploitation requires network reach to the HistoryRead endpoint plus valid credentials (CVSS 4.0 PR:L, aligned with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code is identified at time of analysis, the issue is not in CISA KEV, and VulnCheck reporting places remediation in the current weekly patch cycle rather than an emergency response.
SQL injection in mem0's Databricks vector store backend (mem0/vector_stores/databricks.py) affects versions 0.1.117 up to but not including 1.0.8, and lets remote unauthenticated attackers inject SQL that runs on the configured Databricks SQL warehouse by supplying crafted memory text, metadata values, or message names that reach unescaped string interpolation in the insert() and update() statements. Successful injection gives high confidentiality, integrity, and availability impact on the warehouse, though the assessed vector (AC:H/AT:P) indicates exploitation is not deterministic and requires the non-default Databricks backend to be configured; the trigger mechanics for reliably carrying a payload through mem0's ingestion pipeline are not described in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, the vendor has released the v1.0.8 fix, and the issue carries an act_now priority label with a CVSS 4.0 base score of 9.2.
Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.