https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T22:33:06.628275+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-112005 fkie_cve-2026-112005 2026-10-20T22:33:06.630436+00:00

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

 https://db.gcve.eu/vuln/ghsa-ch4j-xm23-vmm2 GHSA-ch4j-xm23-vmm2 2026-10-20T22:33:06.630513+00:00

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.