tag
Sqlite
Critical
Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459)
CVE-2025-64459·
Django ORM (QuerySet.filter() / Q object construction)
patched
High
Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951
CVE-2026-30951·
Sequelize ORM v6 (Node.js)
patched
Not disclosed (unauthenticated path traversal leading to full admin JWT forgery)
Nezha Dashboard Path Traversal → JWT Secret Leak → Token Forgery — CVE-2026-53519
CVE-2026-53519 (GHSA-5c25-7vpj-9mqh)·
Nezha Dashboard (monitoring/agent management panel)
unpatched
Critical
Ghost CMS Content API — Unauthenticated Blind SQL Injection (CVE-2026-26980)
CVE-2026-26980·
Ghost CMS
patched