Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-88081 | 7.7 high | 1.0% | no CPE yet | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 19 Oct |
| CVE-2026-47296 | 7.5 high | 1.0% | microsoft, microsoft sql server 2016 service pack 3 (gdr), microsoft sql server 2016 service pack 3 azure connect feature pack, microsoft sql server 2017 (cu 31) | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | 16 h ago |
| CVE-2026-67376 | 7.5 high | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-83945 | 6.6 medium | 1.0% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-54116 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-50468 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 16 h ago |
| CVE-2026-67645 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67624 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67369 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu8), microsoft sql server 2025 for x64-based systems (gdr) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-78441 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-69562 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68780 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68779 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68778 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68777 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68776 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67648 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67641 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-67393 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67390 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67386 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-66816 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network. | Sat 31 Oct |
| CVE-2026-73029 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2019 (cu 32), microsoft sql server 2019 (gdr), microsoft sql server 2022 (cu 26) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67389 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2022 (cu 26), microsoft sql server 2022 (gdr), microsoft sql server 2025 (cu8) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67383 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu8), microsoft sql server 2025 for x64-based systems (gdr) | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68784 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-68781 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67633 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-67630 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67629 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-67626 | 6.5 medium | 1.0% | no CPE yet | Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network. | 19 Oct |
| CVE-2026-88084 | 5.3 medium | 1.0% | no CPE yet | Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. | 19 Oct |
| CVE-2026-68785 | 4.9 medium | 1.0% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | Sat 31 Oct |
| CVE-2026-94520 | 4.9 medium | 1.0% | no CPE yet | Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network. | 19 Oct |
| CVE-2026-67628 | 4.9 medium | 1.0% | no CPE yet | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 19 Oct |
| CVE-2026-84058 | 9.8 critical | 0.00% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance. | 14 Oct |
| CVE-2026-114119 | 9.3 critical | 0.00% | no CPE yet | Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM. | Wed 28 Oct |
| CVE-2026-85886 | 8.5 high | 0.00% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-102462 | 8.2 high | 0.00% | eclipse, vert.x | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client. | 20 Oct |
| CVE-2026-68787 | 7.8 high | 0.00% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | Sat 31 Oct |
| CVE-2026-32176 | 7.8 high | 0.00% | microsoft, sql_server_2016, sql_server_2017, sql_server_2019 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-32167 | 7.8 high | 0.00% | microsoft, sql_server_2016, sql_server_2017, sql_server_2019 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. | 26 Oct |
| CVE-2026-88083 | 7.5 high | 0.00% | no CPE yet | Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-77485 | 7.0 high | 0.00% | microsoft, microsoft sql server 2017 (cu 31), microsoft sql server 2017 (gdr), microsoft sql server 2019 (cu 32) | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | Sat 31 Oct |
| CVE-2026-88088 | 7.0 high | 0.00% | no CPE yet | Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-85919 | 7.0 high | 0.00% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-88082 | 7.0 high | 0.00% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-85876 | 7.0 high | 0.00% | no CPE yet | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-88089 | 6.7 medium | 0.00% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | 19 Oct |
| CVE-2026-70189 | 6.7 medium | 0.00% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | 19 Oct |
Download these 106 as CSV · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.