SQL injection vulnerabilities

SQL injection151 advisories42 exploitedlatest 2026-09-11

SQL injection lets attacker input rewrite database queries — dumping tables, bypassing logins, or writing files. Decades old and still shipping, SQLi in internet-facing products (file-transfer appliances in particular) has driven some of the largest mass-exploitation campaigns on record.

Classification is assigned by the CSIRTS enrichment pipeline from the advisory text. The list below shows the latest advisories tagged sql injection, newest first, across national CERTs, vendor PSIRTs and vulnerability databases — exploited marks CVEs in the CISA KEV catalog.

Latest sql injection advisories

[UPDATE] [hoch] Splunk Splunk Enterprise: Mehrere Schwachstellen

highCVE-2026-76251 CVE-2026-76252 CVE-2026-76253 CVE-2026-76254cert-bund2026-09-11

[UPDATE] [hoch] Apache Portable Runtime (APR): Mehrere Schwachstellen

highCVE-2025-49506 CVE-2026-32327 CVE-2026-34191 CVE-2026-34501cert-bund2026-09-11

[UPDATE] [hoch] PHP: Mehrere Schwachstellen

highCVE-2026-17543 CVE-2026-17544 CVE-2026-7260cert-bund2026-09-11

[UPDATE] [hoch] Dell Secure Connect Gateway: Mehrere Schwachstellen

highCVE-2026-61408 CVE-2026-61409 CVE-2026-61410 CVE-2026-78480cert-bund2026-09-10

[UPDATE] [hoch] PostgreSQL: Mehrere Schwachstellen

highCVE-2026-14662 CVE-2026-14663 CVE-2026-14664 CVE-2026-14666cert-bund2026-09-10

[UPDATE] [hoch] Splunk SOAR: Mehrere Schwachstellen

highCVE-2025-13465 CVE-2025-13473 CVE-2025-14550 CVE-2025-15599cert-bund2026-09-04

[UPDATE] [hoch] Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen

highexploitedCVE-2019-13990 CVE-2021-44906 CVE-2022-1471 CVE-2022-23521cert-bund2026-09-04

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

highexploitedCVE-2026-9586 CVE-2026-48710 CVE-2026-49869 CVE-2026-59822cisa2026-09-02

[UPDATE] [high] PostgreSQL: Multiple vulnerabilities

highCVE-2026-6472 CVE-2026-6473 CVE-2026-6474 CVE-2026-6475cert-bund2026-09-02

CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability

criticalexploitedCVE-2026-9586cisa-kev2026-09-02

[UPDATE] [high] Shibboleth Service Provider: Vulnerability Allows SQL Injection

highCVE-2025-9943cert-bund2026-09-01

[NEW] [medium] MariaDB Connectors: Multiple vulnerabilities

mediumCVE-2026-55854 CVE-2026-55855 CVE-2026-55856 CVE-2026-55857cert-bund2026-08-31

[NEW] [high] MongoDB BI Connector and ODBC Driver: Multiple vulnerabilities

highCVE-2026-77184 CVE-2026-77586 CVE-2026-81490 CVE-2026-81517cert-bund2026-08-31

[UPDATE] [high] Roundcube Webmail: Multiple vulnerabilities

highCVE-2026-48842 CVE-2026-48843 CVE-2026-48845 CVE-2026-48846cert-bund2026-08-31

[NEW] [high] CKAN: Multiple vulnerabilities

highcert-bund2026-08-28

[NEW] [high] ServiceNow Now Platform and AI Platform: Multiple vulnerabilities

highCVE-2026-18885 CVE-2026-18886 CVE-2026-6876 CVE-2026-74820cert-bund2026-08-28

[NEW] [high] Wazuh: Multiple vulnerabilities

highCVE-2026-54083 CVE-2026-54084 CVE-2026-54085 CVE-2026-61783cert-bund2026-08-28

[NEW] [high] Fleet: Multiple vulnerabilities

highCVE-2026-48786 CVE-2026-54245cert-bund2026-08-27

[NEW] [high] Veeam ONE: Multiple Vulnerabilities

highCVE-2026-58074 CVE-2026-58075 CVE-2026-64630 CVE-2026-64631cert-bund2026-08-27

[NEW] [high] ILIAS: Multiple vulnerabilities

highCVE-2026-18745cert-bund2026-08-27

[NEW] [critical] TYPO3 Extensions: Multiple Vulnerabilities

criticalCVE-2026-56092 CVE-2026-56093 CVE-2026-56094 CVE-2026-56095cert-bund2026-08-26

[NEW] [critical] GeoServer: Vulnerability allows SQL injection and potentially code execution

criticalcert-bund2026-08-25

NCSC-2026-0325 [1.00] [M/H] Kwetsbaarheden verholpen in Atlassian producten

unknownCVE-2021-44906 CVE-2022-3517 CVE-2023-45133 CVE-2025-14813ncsc-nl2026-08-24

Multiple vulnerabilities in Metabase (August 24, 2026)

unknownexploitedCVE-2026-72900 CVE-2026-72898 CVE-2026-72899cert-fr-avis2026-08-24

[UPDATE] [high] BigBlueButton: Multiple Vulnerabilities

highCVE-2026-46355 CVE-2026-46682cert-bund2026-08-21

CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

unknownCVE-2026-14471aws2026-08-20

[NEW] [medium] Cisco Unified Intelligence Center: Vulnerability enables SQL injection

mediumCVE-2026-20327cert-bund2026-08-20

Cisco Unified Intelligence Center SQL Injection Vulnerability

mediumCVE-2026-20327cisco-psirt2026-08-19

NCSC-2026-0313 [1.00] [M/H] Vulnerabilities resolved in Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher

unknownCVE-2026-61302 CVE-2026-61305 CVE-2026-71055 CVE-2026-71056ncsc-nl2026-08-19

[UPDATE] [high] Froxlor: Multiple Vulnerabilities

highCVE-2026-62988 CVE-2026-54347 CVE-2026-54348 CVE-2026-54543cert-bund2026-08-19

[NEW] [high] SuiteCRM: Vulnerability enables SQL injection

highCVE-2026-71548cert-bund2026-08-18

NCSC-2026-0304 [1.00] [M/H] ZeroDay Vulnerability Fixed in GeoTools by OpenGeo

unknownCVE-2023-25158ncsc-nl2026-08-18

[NEW] [high] Budibase: Multiple vulnerabilities

highcert-bund2026-08-18

[UPDATE] [high] Budibase: Vulnerability enables SQL injection and code execution

highCVE-2026-64657cert-bund2026-08-18

[UPDATE] [high] PostgreSQL: Vulnerability enables SQL injection and code execution

highCVE-2025-1094cert-bund2026-08-17

[NEW] [high] pgAdmin: Multiple vulnerabilities

highCVE-2026-17346 CVE-2026-17347 CVE-2026-17349 CVE-2026-17350cert-bund2026-08-17

[UPDATE] [high] pgAdmin: Multiple vulnerabilities

highCVE-2026-12045 CVE-2026-12046 CVE-2026-12047 CVE-2026-12048cert-bund2026-08-17

[UPDATE] [high] pgAdmin: Multiple vulnerabilities

highCVE-2026-7813 CVE-2026-7815 CVE-2026-7816 CVE-2026-7817cert-bund2026-08-17

NCSC-2026-0301 [1.00] [M/H] Vulnerabilities patched in IBM i operating system by IBM

unknownCVE-2026-16722 CVE-2026-16860 CVE-2026-16863 CVE-2026-16907ncsc-nl2026-08-14

[NEW] [high] IBM i: Multiple Vulnerabilities

highCVE-2026-16722 CVE-2026-16860 CVE-2026-16863 CVE-2026-16907cert-bund2026-08-14

Multiple vulnerabilities in Tenable Security Center (August 14, 2026)

unknownCVE-2026-19679 CVE-2026-19635 CVE-2026-19628 CVE-2026-19626cert-fr-avis2026-08-14

[UPDATE] [high] Cacti: Multiple Vulnerabilities

highCVE-2026-1513 CVE-2026-22802 CVE-2026-32935 CVE-2026-39893cert-bund2026-08-12

NCSC-2026-0291 [1.00] [M/H] Vulnerabilities patched in Adobe Campaign Classic

unknownCVE-2026-27302 CVE-2026-48381 CVE-2026-71398ncsc-nl2026-08-12

[NEW] [medium] Broadcom Brocade SANnav: Multiple vulnerabilities

mediumCVE-2026-5047 CVE-2026-5048 CVE-2026-5049cert-bund2026-08-12

[NEW] [high] n8n: Multiple vulnerabilities

highcert-bund2026-08-12

DSA-6435-1 spip - security update

unknownCVE-2026-66738debian2026-08-12

NCSC-2026-0283 [1.00] [M/H] Vulnerabilities in Veeam ONE

unknownCVE-2026-58074 CVE-2026-58075 CVE-2026-64630 CVE-2026-64631ncsc-nl2026-08-11

CISA Adds Three Known Exploited Vulnerabilities to Catalog

highexploitedCVE-2026-20349 CVE-2026-68820 CVE-2026-72898cisa2026-08-11

[UPDATE] [medium] OX Dovecot Pro: Multiple Vulnerabilities

mediumCVE-2026-27851 CVE-2026-40016 CVE-2026-33603 CVE-2026-40020cert-bund2026-08-11

[UPDATE] [medium] Dovecot: Multiple vulnerabilities

mediumCVE-2025-30189 CVE-2025-59028 CVE-2025-59032 CVE-2026-24031cert-bund2026-08-11

Other vulnerability classes

Remote code execution (2219)Privilege escalation (1662)Authentication bypass (1292)Denial of service (2399)Information disclosure (1760)Memory corruption (1507)Path traversal (266)Code injection (408)Cross-site scripting (344)Unsafe deserialization (87)Server-side request forgery (124)

New sql injection advisories, in your inbox. The daily briefing covers every advisory in this class the morning after it lands. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.