https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T20:11:01.358798+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-112005 CVE-2026-112005 — WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor 2026-10-20T20:11:01.360833+00:00

Affected: clidey whodb

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.