CVE-2026-8726 — The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "D — CVE Database · The Intelligence Room