CVE-2026-121262

The record

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-110816 ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert… CWE-704
• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-704
• CVE-2026-10080 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to… CWE-704
• CVE-2026-15826 The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via… CWE-704
• CVE-2026-53798 rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… CWE-704
• CVE-2026-73429 Russh is a Rust SSH client & server library. CWE-704
• CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the… CWE-704
• CVE-2026-6726 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that… CWE-704