CVE-2026-0824

A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.1.10 is recommended to address this issue. The patch is identified as b42fd9f18476d844ae181a10a249e003dafb823d. You should upgrade the affected component. The vendor confirmed early that the fix "is going to be released as a part of QuestDB 9.3.0" as well.

• CWE-79
• CWE-94

• https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20QuestDB%20database.md
• https://github.com/questdb/questdb/releases/tag/9.3.0
• https://github.com/questdb/ui/
• https://github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823d
• https://github.com/questdb/ui/pull/518
• https://github.com/questdb/ui/pull/519#issue-3790862030
• https://vuldb.com/?ctiid.340357
• https://vuldb.com/?id.340357
• https://vuldb.com/?submit.733253

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0818When a user explicitly requested Thunderbird to decrypt an i…4.3
• CVE-2026-0819A stack buffer overflow vulnerability exists in wolfSSL's PK…7.1
• CVE-2026-0820The RepairBuddy – Repair Shop CRM & Booking Plugin for WordP…4.3
• CVE-2026-0821A vulnerability was determined in quickjs-ng quickjs up to 0…9.8
• CVE-2026-0822A vulnerability was identified in quickjs-ng quickjs up to 0…8.8
• CVE-2026-0823Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-0825The Database for Contact Form 7, WPforms, Elementor forms pl…5.3
• CVE-2026-0826In certain scenarios when the admin has enabled Interactive …9.2
• CVE-2026-0827During an internal security assessment, a potential vulnerab…7.1
• CVE-2026-0828Kernel driver ProcessMonitorDriver.sys in Safetica's endpoin…7.5
• CVE-2026-0829The Frontend File Manager Plugin WordPress plugin through 23…5.8
• CVE-2026-0830Processing specially crafted workspace folder names could al…8.4