SQL Injection found on ibm.com subdomain

Bug reported by was disclosed at October 12, 2026, 4:03 pm   |   SQL Injection

A SQL injection vulnerability was identified on a subdomain, reported to the vendor, analyzed, and remediated.

Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write

Bug reported by Yalguun Tumenkhuu was disclosed at October 12, 2026, 9:27 am   |   Memory Corruption - Generic

A memory corruption vulnerability was discovered in the MariaDB Connector/ODBC driver. When a malicious server sent a handshake with an excessively long version string exceeding approximately 500 bytes, a custom snprintf function returned a negative value. This negative value was added to an unsigned integer, causing integer wraparound. The corrupted value was subsequently used as an offset into a fixed-size buffer, resulting in out-of-bounds heap writes. The vulnerability was triggered unauthenticated and remotely when an application allocated a statement on a poisoned connection. The flaw was confirmed to cause heap buffer overflow with address sanitizer testing on the driver built from source.

Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path

Bug reported by Yalguun Tumenkhuu was disclosed at October 12, 2026, 9:26 am   |   Out-of-bounds Read

A heap out-of-bounds read vulnerability was identified in the connector library when processing binary result sets. The vulnerability occurred because the buffer for each result column was sized based on the server-declared column length, but then the actual field length reported by the server in row packets was read from that buffer without proper bounds checking. A malicious server could declare a small column length while sending a larger field value, causing adjacent process memory to be read and leaked into application-visible column values or triggering a process crash. The vulnerability was reachable through the binary protocol path when server-side prepared statements were used or when stored procedure calls were executed. Information disclosure of adjacent heap memory and denial of service were possible impacts.

r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )

Bug reported by Yalguun Tumenkhuu was disclosed at October 12, 2026, 9:06 am   |   Uncontrolled Resource Consumption

A server-controlled PBKDF2 iteration count vulnerability was discovered in the Parsec authentication plugin. The iteration value was read directly from the server response and only validated against a minimum threshold, allowing a malicious server to force excessive cryptographic computations. An attacker could specify a high iteration count that resulted in approximately 1.07 billion PBKDF2-HMAC-SHA512 rounds, causing a client CPU core to be pinned for extended periods during connection attempts. The vulnerability was introduced by a prior commit that loosened the iteration count validation. This vulnerability could be exploited repeatedly without valid credentials and was exposed by default plaintext connections.

Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint

Bug reported by Winston Crooker was disclosed at October 12, 2026, 6:53 am   |   Improper Access Control - Generic

A forum plugin version 2.7.0 registered post types with REST API exposure without enforcing the same access restrictions applied on other platforms. Private and hidden forum topics and replies were stored with public status, and forum visibility was only enforced through query filters that were bypassed by direct REST API single-item requests. Unauthenticated attackers could retrieve the full content of restricted forum posts by making direct REST API calls with sequential post identifiers. The vulnerability was not present in the previous release line, which did not expose these post types to the REST API.