Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-79849 | 10.0 critical | 1.0% | no CPE yet | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-49257 | 10.0 critical | 1.0% | no CPE yet | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster. This issue has been fixed in version 3.1.0 | Mon 26 Oct |
| CVE-2026-56162 | 10.0 critical | 1.0% | microsoft, azure_sql_database | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-62836 | 10.0 critical | 1.0% | microsoft, azure_sql_managed_instance | Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network. | 24 Oct |
| CVE-2026-48330 | 10.0 critical | 1.0% | adobe, campaign | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this issue does not require user interaction. Scope is changed. | 23 Oct |
| CVE-2025-42890 | 10.0 critical | 1.0% | no CPE yet | SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system. | 18 Oct |
| CVE-2026-55572 | 10.0 critical | 1.0% | no CPE yet | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7. | 16 Oct |
| CVE-2026-69502 | 10.0 critical | 1.0% | microsoft, azure_sql_database | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | 15 Oct |
| CVE-2026-27681 | 9.9 critical | 1.0% | no CPE yet | Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system. | Mon 26 Oct |
| CVE-2026-7329 | 9.9 critical | 1.0% | progress, marklogic_server | An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access. | 24 Oct |
| CVE-2026-63232 | 9.9 critical | 1.0% | no CPE yet | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server. | 23 Oct |
| CVE-2026-63233 | 9.9 critical | 1.0% | no CPE yet | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server. | 23 Oct |
| CVE-2026-63234 | 9.9 critical | 1.0% | no CPE yet | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server. | 23 Oct |
| CVE-2026-58046 | 9.9 critical | 1.0% | no CPE yet | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel. | 23 Oct |
| CVE-2026-69085 | 9.9 critical | 1.0% | no CPE yet | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance. | 23 Oct |
| CVE-2026-48326 | 9.9 critical | 1.0% | adobe, campaign | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | 23 Oct |
| CVE-2026-68782 | 9.9 critical | 1.0% | microsoft, azure_sql_database | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-68789 | 9.9 critical | 1.0% | microsoft, azure_sql_database | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 18 Oct |
| CVE-2026-67643 | 9.8 critical | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 19 h ago |
| CVE-2026-67631 | 9.8 critical | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 19 h ago |
| CVE-2026-79858 | 9.8 critical | 1.0% | no CPE yet | An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service. | Fri 30 Oct |
| CVE-2026-42990 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2023-0758 | 9.8 critical | 1.0% | jfinaloa_project, jfinaloa | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability. | Wed 28 Oct |
| CVE-2023-1357 | 9.8 critical | 1.0% | simple_bakery_shop_management_system_project, simple_bakery_shop_management_system | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222860. | Wed 28 Oct |
| CVE-2023-46453 | 9.8 critical | 1.0% | no CPE yet | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200. | Wed 28 Oct |
| CVE-2025-67066 | 9.8 critical | 1.0% | no CPE yet | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path | Mon 26 Oct |
| CVE-2026-79852 | 9.8 critical | 1.0% | no CPE yet | A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-79854 | 9.8 critical | 1.0% | no CPE yet | A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-9711 | 9.8 critical | 1.0% | no CPE yet | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists. | Sun 25 Oct |
| CVE-2026-13766 | 9.8 critical | 1.0% | no CPE yet | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers (order_by, where-clause column keys, field and returning lists, upsert columns, and join aliases) reach the SQL string raw, while values are placeholder-bound and unaffected. A caller that forwards untrusted input to an affected identifier position, such as a user-controlled order_by value, enables SQL injection: the row order can be made to depend on a sub-select over columns the query never selected, and the where and update identifier positions permit further data disclosure and tampering. | Sun 25 Oct |
| CVE-2026-9074 | 9.8 critical | 1.0% | ibm, api_connect | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality. | Sun 25 Oct |
| CVE-2026-52186 | 9.8 critical | 1.0% | no CPE yet | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component | Sun 25 Oct |
| CVE-2026-5801 | 9.8 critical | 1.0% | no CPE yet | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection. This issue affects SEM-PMP: through 23042026. | Sun 25 Oct |
| CVE-2026-51821 | 9.8 critical | 1.0% | no CPE yet | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint | 24 Oct |
| CVE-2026-15043 | 9.8 critical | 1.0% | no CPE yet | DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows. | 24 Oct |
| CVE-2026-62390 | 9.8 critical | 1.0% | apache, kylin | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue. | 24 Oct |
| CVE-2026-53421 | 9.8 critical | 1.0% | apache, syncope | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox. | 24 Oct |
| CVE-2026-57308 | 9.8 critical | 1.0% | apache, syncope | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue. | 24 Oct |
| CVE-2026-72599 | 9.8 critical | 1.0% | no CPE yet | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials. | 24 Oct |
| CVE-2026-72565 | 9.8 critical | 1.0% | no CPE yet | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. | 24 Oct |
| CVE-2026-71207 | 9.8 critical | 1.0% | no CPE yet | The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path. | 24 Oct |
| CVE-2026-71231 | 9.8 critical | 1.0% | no CPE yet | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. | 24 Oct |
| CVE-2026-73211 | 9.8 critical | 1.0% | no CPE yet | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6. | 24 Oct |
| CVE-2023-25207 | 9.8 critical | 1.0% | prestashop, dpd_france | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | 24 Oct |
| CVE-2023-30191 | 9.8 critical | 1.0% | cdesigner_project, cdesigner | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). | 23 Oct |
| CVE-2026-32227 | 9.8 critical | 1.0% | apache, ranger | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. | 23 Oct |
| CVE-2025-12463 | 9.8 critical | 1.0% | no CPE yet | An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19. | 18 Oct |
| CVE-2026-63037 | 9.8 critical | 1.0% | apache, inlong | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/issues/12079 . | 18 Oct |
| CVE-2026-63038 | 9.8 critical | 1.0% | apache, inlong | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/issues/12135 . | 18 Oct |
| CVE-2026-55642 | 9.8 critical | 1.0% | no CPE yet | dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51. | 18 Oct |
Download these 401 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.