CVE Watch23 jul 2026

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote co

CVSS

10.0

Crítico

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 23 jul 2026 · Última mod.: 23 jul 2026 · CWE-20 · CWE-94 · CWE-1188

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-659079.1 CRÍ

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible5h CVE-2026-659068.8 ALT

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible5h CVE-2026-648158.1 ALT

—

——0In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files6h CVE-2026-648037.8 ALT

—

——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK6h CVE-2026-648027.8 ALT

—

——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration6h CVE-2026-595439.9 CRÍ

—

——0Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.6h