CVE-2026-47295: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-58225

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

PT-2026-58125

Name of the Vulnerable Software and Affected Versions SQL Server ODBC driver affected versions not specified Description A heap-based buffer overflow in the SQL Server ODBC driver allows an unauthorized remote attacker to execute arbitrary code over a network and achieve elevation of privilege. A...

CVE-2026-54116: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-54117: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

KLA91145 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products ESU. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

CVE-2026-42990: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...

KLA91153 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

CVE-2026-50468: Buffer Over-read

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network...

PT-2026-58246

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally...

CVE-2026-47296: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-55002: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

Security Updates for Microsoft SQL Server (July 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over...

CVE-2026-54118: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

KLA91151 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation...

PYSEC-2026-2370 Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.Thisvulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...

PT-2026-59050

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use get sqlalchemy connection and someone with access to connection resources...

CVE-2026-50180: Improper Limitation of a Pathname to a Restricted Directory

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses...

The vulnerability of the MSSQL plugin on the Grafana monitoring and observation platform allows a hacker to bypass security restrictions and cause a service failure.

The vulnerability of the MSSQL plugin platform for Grafana monitoring and observation is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions and cause service failures...