By weakness (CWE)

CWE-943: related vulnerabilities

CVEs classified under CWE-943. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

10 published vulnerabilities

• CVE-2026-47835HIGH 8.6

  Spring AI's vector store implementations for Elasticsearch, OpenSearch, and GemFire contain a query injection vulnerability. An attacker can inject specially crafted characters into vector store queries to execute arbitrary database operations without authentication. This affects Spring AI versions 1.0.0–1.0.8 and 1.1.0–1.1.7, with fixes available in 1.0.9 and 1.1.8 respectively.

• CVE-2026-46591HIGH 8.2

  Apache Camel's Neo4j integration contains a query injection flaw that lets attackers manipulate database queries by crafting malicious property names in match operations. Although previous patches blocked injection through property values, the property names themselves are still inserted directly into Cypher queries without escaping. If your application routes untrusted data—such as JSON request bodies or headers—into the Neo4j producer's match configuration, an attacker can inject arbitrary Cypher syntax to read, modify, or delete any data in your Neo4j database. The vulnerability exists in Camel versions from 4.10.0 through 4.20.x, with patches available in 4.14.8 (LTS), 4.18.3, and 4.21.0+.

• CVE-2026-44840HIGH 7.5

  Dgraph versions before 25.3.4 contain a query injection vulnerability in the `checkUserPassword` GraphQL endpoint. Attackers can exploit this by submitting specially crafted passwords that break out of the intended query structure and inject arbitrary database commands. The vulnerability requires no authentication and can be triggered remotely, allowing attackers to read sensitive data from the database without permission.

• CVE-2026-10698HIGH 7.2

  Progress MOVEit Transfer contains a vulnerability in its Custom Reports modules that allows authenticated administrators to inject malicious data into query logic. An attacker with administrative privileges can manipulate report queries to access or modify data beyond their intended scope. The vulnerability affects recent versions of MOVEit Transfer and requires administrative access to exploit, limiting the immediate risk to organizations where admin accounts are properly secured and monitored.

• CVE-2026-53674HIGH 7.1

  BuddyPress 14.4.0 has a flaw in how it processes @mention names when a specific username compatibility feature is enabled. Attackers can craft malicious mention text containing special regex characters that slip past the software's input sanitization, allowing them to probe the database for usernames or crash the system through resource exhaustion. The vulnerability requires an attacker to be logged in but poses meaningful risk to information disclosure and availability.

• CVE-2026-54019MEDIUM 6.5

  Open WebUI, a self-hosted AI platform designed for offline operation, contains a vulnerability in how it controls access to data collections when running in Milvus multitenancy mode. Even though version 0.9.6 added access controls at the collection level, an attacker with valid credentials can bypass these protections by exploiting how user-supplied collection names are processed. The vulnerability allows an authenticated user to access or manipulate collections they should not have permission to view, potentially exposing sensitive AI training data or model information. This is a partial fix for an earlier vulnerability (CVE-2026-44560) that was incompletely addressed.

• CVE-2026-8649MEDIUM 6.4

  Progress MOVEit Transfer contains a vulnerability in its Custom Reports module that allows an authenticated user with administrative privileges to inject malicious input into report queries. By crafting specially designed data, an attacker can manipulate how the application processes database queries, potentially leading to unauthorized access to sensitive information or modification of report data. The vulnerability requires high user privileges and interaction to exploit, making it a moderate-risk issue primarily relevant to organizations where administrator accounts may be compromised or where insider threats exist.

• CVE-2026-41696MEDIUM 5.9

  Spring Data MongoDB, a widely-used persistence framework for MongoDB, contains a query injection vulnerability affecting multiple versions. When developers use the @Query annotation with regex parameter binding, the framework fails to properly validate user-supplied input. This allows an attacker to craft a malicious string that escapes the intended regex boundaries and inject arbitrary queries. The vulnerability does not currently appear on the CISA KEV catalog, but the broad version range affected and the sensitive nature of database queries make it a meaningful risk for organizations relying on Spring Data MongoDB.

• CVE-2026-41697MEDIUM 4.8

  Spring Data Relational, a widely-used Java framework for database access, contains a vulnerability in its Query By Example (QBE) feature. When developers use string matching options like STARTING, ENDING, or CONTAINING, the framework fails to properly escape wildcard characters from user-supplied input. An attacker can exploit this by injecting wildcard characters to perform boolean-based blind SQL inference attacks—essentially asking yes-or-no questions about the underlying database without directly viewing the data. The vulnerability affects multiple versions across 2.4, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, and 4.0 release lines.

• CVE-2026-49482MEDIUM 4.3

  ClipBucket v5 has a vulnerability in its subtitle editing feature that allows authenticated users to corrupt subtitle data across multiple videos at once. By sending a specially crafted request with a wildcard character, an attacker with valid credentials can overwrite all subtitle titles for any video they control in a single action. This is a data integrity issue rather than a data exposure risk, and affects versions before 5.5.3 - #141.