Microsoft SQL Server Elevation of Privilege Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

SQL Server ODBC driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...

CVE-2026-47295: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-58125

Name of the Vulnerable Software and Affected Versions SQL Server ODBC driver affected versions not specified Description A heap-based buffer overflow in the SQL Server ODBC driver allows an unauthorized remote attacker to execute arbitrary code over a network and achieve elevation of privilege. A...

CVE-2026-50468: Buffer Over-read

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-54116: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-55002: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-54118: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

CVE-2026-54117: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

CVE-2026-42990: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...

CVE-2026-47296: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-58225

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

PT-2026-58246

Name of the Vulnerable Software and Affected Versions SQL Server versions 2016 through 2025 Description An authorized attacker can elevate privileges locally due to external control of a file name or path. This allows an authenticated local user to gain administrative control over the database...

KLA91145 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products ESU. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

KLA91151 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation...

KLA91153 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

Security Updates for Microsoft SQL Server (July 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over...

PYSEC-2026-2370 Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.Thisvulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...