Vulnerabilities
Report: Update: CVE-2026-44349 - Daptin fuzzy search injects unvalidated column name into raw SQL
CVE ID :CVE-2026-44349 Published : May 7, 2026, 1:57 p.m. | 1 hour, 8 minutes ago Description :Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf(
CVE Details
CVE ID
Published
May 7, 2026