https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 08:38:03 +0000 https://vulnerability.circl.lu/sighting/64f1ae3c-24c5-413c-9de3-674d2ff94305/export {"uuid": "64f1ae3c-24c5-413c-9de3-674d2ff94305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxnaxosyub2n", "content": "databasement 1.8.2 \u672a\u6e80\u3067\u3001\u8a8d\u8a3c\u6e08\u307f\u30e6\u30fc\u30b6\u30fc\u304c\u6307\u5b9a\u3057\u305fDB\u540d\u3067\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u3002\nCVE-2026-108963 CVSS 8.8 | HIGH", "creation_timestamp": "2026-10-12T00:25:15.095856Z"} {"uuid": "64f1ae3c-24c5-413c-9de3-674d2ff94305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxnaxosyub2n", "content": "databasement 1.8.2 \u672a\u6e80\u3067\u3001\u8a8d\u8a3c\u6e08\u307f\u30e6\u30fc\u30b6\u30fc\u304c\u6307\u5b9a\u3057\u305fDB\u540d\u3067\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u3002\nCVE-2026-108963 CVSS 8.8 | HIGH", "creation_timestamp": "2026-10-12T00:25:15.095856Z"} https://vulnerability.circl.lu/sighting/64f1ae3c-24c5-413c-9de3-674d2ff94305/export Mon, 12 Oct 2026 00:25:15 +0000 https://vulnerability.circl.lu/sighting/37b010b9-0c55-4ad7-b8df-1133e1d91237/export {"uuid": "37b010b9-0c55-4ad7-b8df-1133e1d91237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hhgsb33gb7kuv", "content": "CVE-2026-108963 - Databasement Argument Injection Remote Code Execution\nCVE ID : CVE-2026-108963\n \n Published : Oct. 11, 2026, 8:16 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mar...", "creation_timestamp": "2026-10-11T21:48:10.980668Z"} {"uuid": "37b010b9-0c55-4ad7-b8df-1133e1d91237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hhgsb33gb7kuv", "content": "CVE-2026-108963 - Databasement Argument Injection Remote Code Execution\nCVE ID : CVE-2026-108963\n \n Published : Oct. 11, 2026, 8:16 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mar...", "creation_timestamp": "2026-10-11T21:48:10.980668Z"} https://vulnerability.circl.lu/sighting/37b010b9-0c55-4ad7-b8df-1133e1d91237/export Sun, 11 Oct 2026 21:48:10 +0000 https://vulnerability.circl.lu/sighting/8b114253-ba6a-41a9-b5ef-aba144469a05/export {"uuid": "8b114253-ba6a-41a9-b5ef-aba144469a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmxa7wfnu2n", "content": "\ud83d\udfe0 CVE-2026-108963 - High (8.8)\n\ndatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., ma...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108963/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T21:31:04.097239Z"} {"uuid": "8b114253-ba6a-41a9-b5ef-aba144469a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmxa7wfnu2n", "content": "\ud83d\udfe0 CVE-2026-108963 - High (8.8)\n\ndatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., ma...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108963/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T21:31:04.097239Z"} https://vulnerability.circl.lu/sighting/8b114253-ba6a-41a9-b5ef-aba144469a05/export Sun, 11 Oct 2026 21:31:04 +0000 https://vulnerability.circl.lu/sighting/dce3a191-bebc-47f7-8d69-6e87c47aa397/export {"uuid": "dce3a191-bebc-47f7-8d69-6e87c47aa397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117424010937970260", "content": "CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108963https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcmhttps://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862chttps://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3#David-Crty #databasement#CVE_2026_108963#bot", "creation_timestamp": "2026-10-11T19:50:14.235155Z"} {"uuid": "dce3a191-bebc-47f7-8d69-6e87c47aa397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108963", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117424010937970260", "content": "CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108963https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcmhttps://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862chttps://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3#David-Crty #databasement#CVE_2026_108963#bot", "creation_timestamp": "2026-10-11T19:50:14.235155Z"} https://vulnerability.circl.lu/sighting/dce3a191-bebc-47f7-8d69-6e87c47aa397/export Sun, 11 Oct 2026 19:50:14 +0000