Rapid7 finds a 9.8 SQL injection in Channel Software's WebAlliance commerce platform
Rapid7 disclosed CVE-2026-108065, a CVSS 9.8 SQL injection in Channel Software WebAlliance that lets an unauthenticated attacker read user PII and passwords. With admin database rights, the same request runs system commands on the server.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+8
- Incentives62
- Confidence60
buildOne report1 publisher Couchbase fingerprint matches 9,045 services on the public internet
ZoomEye's Couchbase fingerprint matched 9,045 services reachable from the public internet on 24 September 2026. The query cannot say which Couchbase surface answered, so each team has to check its own inventory against the result.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher PostgreSQL accepts SET NULL foreign keys that fail only when a parent row is deleted
PostgreSQL 18.3 accepts three kinds of ON DELETE SET NULL key at creation and rejects them only when a parent with children is deleted. A Schemity post that tested each case says to pick every key's action by what the child row means once its parent is gone.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap0
- Incentives30
- Confidence62
buildOne report1 publisher A Spring JDBC search demo moves role visibility out of a StringBuilder and into Strategy classes
Posted on dev.to, a Spring JDBC demo splits a five-role, ten-filter SQL Server search into two Strategy families that feed one rule-enforcing query builder. The legacy version buries a delegation rule in five appends and fetches admin-only emails for every role.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher A SQL Server restart zeroes the usage counters that justify dropping an index
sys.dm_db_index_usage_stats counts seeks, scans and lookups only since the instance came up, so an index with no reads may just be waiting for its monthly job. One cross join puts that window in the report.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap−12
- Incentives20
- Confidence72
buildOne report1 publisher At least five ordering questions hide inside one updated_at column
A dev.to walkthrough of PostgreSQL snapshots, LSNs and Oracle SCNs sets out why a row version has no commit coordinate to record when it is written, and what that indirection costs the replication and audit consumers that read it later.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap−8
- Incentives30
- Confidence58
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
buildOne report1 publisher Sling's incremental mode leaves five cancelled orders alive in the warehouse
One walkthrough runs both of Sling's modes against a single MySQL table, and the polling mode finishes clean while five cancelled orders stay behind in DuckDB. That gap is a property of SELECT, not of scheduling.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+12
- Incentives76
- Confidence58
Orphan-free quote references place the Love Electric sample inside a production database
A forum seller wants $600 for what they say are 877,000 EV salary sacrifice driver records, and the 999-row sample published as proof holds up under structural testing in ways a fabricated file usually does not.
Reality
- Evidence58
- Adoption22
- Hype gap+20
- Incentives62
- Confidence55
buildOne report1 publisher A green backup job proves the write; only a second instance and CHECKDB prove retrieval
A dev.to walkthrough automates restore plus CHECKDB on a scratch instance. The interesting part is why homegrown versions fail: backup history lives in msdb on the server you are trying to prove.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+28
- Incentives24
- Confidence45
buildOne report1 publisher Before you restart that Windows service, find out whether StartType survived the update
A five-move walkthrough of a stopped SQL Server argues for evidence before action. The restart that clears the alert also rotates the log that would have explained the repeat.
Reality
- Evidence34
- Adoption15
- Hype gap+14
- Incentives24
- Confidence42
buildOne report1 publisher A foreign-key cycle where every column is NOT NULL cannot take its first row
The defect belongs to the graph, not to any one relationship, so diagram review and migration both pass it. It surfaces the first time somebody seeds an empty database.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives68
- Confidence58
Unit 42's Credential Brief: Hunt The Login That Succeeds Right After The Failures
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality
- Evidence46
- Adoption58
- Hype gap+12
- Incentives78
- Confidence44