Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 05:13:37 +0000 CVE-2026-115331 — Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters https://db.gcve.eu/vuln/cve-2026-115331 <p><strong>Affected:</strong> uselotus lotus</p> <p>Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.</p> <p><strong>Affected:</strong> uselotus lotus</p> <p>Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.</p> https://db.gcve.eu/vuln/cve-2026-115331