106 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-105781 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL | CRITICAL | 10.0 | 44%ile | NVD | 2026-10-27 |
| CVE-2026-105489 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL | CRITICAL | 9.9 | 41%ile | NVD | 2026-10-27 |
| CVE-2026-10757 | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may all | CRITICAL | 9.8 | 39%ile | NVD | 2026-10-26 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fine | CRITICAL | 9.8 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-61620 | HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other a | CRITICAL | 9.8 | 33%ile | NVD | 2026-10-30 |
| CVE-2026-111444 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) | CRITICAL | 9.8 | 25%ile | Microsoft | 2026-10-13 |
| CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | CRITICAL | 9.8 | 26%ile | Microsoft | 2026-07-14 |
| CVE-2026-103792 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | CRITICAL | 9.6 | 31%ile | NVD | 2026-10-28 |
| CVE-2026-102788 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the | CRITICAL | 9.3 | 33%ile | NVD | 2026-10-27 |
| CVE-2026-111411 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Aut | CRITICAL | 9.3 | 28%ile | NVD | 2026-10-28 |
| CVE-2026-115607 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP | CRITICAL | 9.3 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-114358 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the | CRITICAL | 9.3 | 43%ile | NVD | 2026-10-29 |
| CVE-2026-115964 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Mot | CRITICAL | 9.3 | 25%ile | NVD | 2026-10-29 |
| CVE-2026-39732 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | CRITICAL | 9.3 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-62048 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell | CRITICAL | 9.3 | 28%ile | NVD | 2026-11-01 |
| CVE-2026-119418 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidat | CRITICAL | 9.2 | 41%ile | NVD | 2026-10-30 |
| CVE-2026-119419 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidat | CRITICAL | 9.2 | 34%ile | NVD | 2026-10-30 |
| CVE-2026-104354 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL | CRITICAL | 9.1 | 42%ile | NVD | 2026-10-27 |
| CVE-2026-105779 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL | CRITICAL | 9.1 | 22%ile | NVD | 2026-10-27 |
| CVE-2026-14571 | A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation a | CRITICAL | 9.1 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-62849 | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengin | CRITICAL | 9.1 | 43%ile | NVD | 2026-10-30 |
| CVE-2026-106076 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of th | CRITICAL | 9.0 | 30%ile | NVD | 2026-10-27 |
| CVE-2026-116818 | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers t | HIGH | 8.8 | 37%ile | NVD | 2026-10-27 |
| CVE-2026-65874 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) a | HIGH | 8.8 | 20%ile | NVD | 2026-10-30 |
| CVE-2026-15741 | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | HIGH | 8.8 | 38%ile | Microsoft | 2026-08-11 |
| CVE-2026-6637 | PostgreSQL refint allows stack buffer overflow and SQL injection | HIGH | 8.8 | 31%ile | Microsoft | 2026-05-12 |
| CVE-2026-49142 | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that all | HIGH | 8.7 | 29%ile | NVD | 2026-10-29 |
| CVE-2026-119655 | CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint | HIGH | 8.7 | 27%ile | NVD | 2026-10-30 |
| CVE-2026-119656 | CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPag | HIGH | 8.7 | 27%ile | NVD | 2026-10-30 |
| CVE-2026-2613 | The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the struc | HIGH | 8.7 | — | NVD | 2026-11-02 |
| CVE-2026-116808 | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data | HIGH | 8.6 | 32%ile | NVD | 2026-10-27 |
| CVE-2026-89216 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL stat | HIGH | 8.6 | 20%ile | NVD | 2026-10-29 |
| CVE-2026-118378 | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute | HIGH | 8.5 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-111850 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPr | HIGH | 8.5 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-115603 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH | HIGH | 8.5 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-115965 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPr | HIGH | 8.5 | 22%ile | NVD | 2026-10-29 |
| CVE-2026-39736 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngi | HIGH | 8.5 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-61996 | Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | HIGH | 8.5 | 32%ile | NVD | 2026-10-29 |
| CVE-2026-77879 | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authenti | HIGH | 8.5 | — | NVD | 2026-11-02 |
| CVE-2026-65151 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful explo | HIGH | 8.4 | 8%ile | NVD | 2026-10-27 |
| CVE-2025-68393 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o | HIGH | 8.4 | 10%ile | NVD | 2026-10-30 |
| CVE-2025-68394 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o | HIGH | 8.4 | 10%ile | NVD | 2026-10-30 |
| CVE-2026-61654 | Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook | HIGH | 8.3 | 32%ile | NVD | 2026-10-29 |
| CVE-2026-54455 | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior t | HIGH | 7.6 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-61569 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passe | HIGH | 7.5 | 21%ile | NVD | 2026-10-28 |
| CVE-2026-93855 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' paramete | HIGH | 7.5 | 35%ile | NVD | 2026-10-29 |
| CVE-2026-93904 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic S | HIGH | 7.5 | 40%ile | NVD | 2026-10-29 |
| CVE-2026-110184 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, a | HIGH | 7.5 | 37%ile | NVD | 2026-10-29 |
| CVE-2026-45145 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `publ | HIGH | 7.5 | 29%ile | NVD | 2026-10-30 |
| CVE-2026-119163 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulne | HIGH | 7.5 | 23%ile | NVD | 2026-10-31 |
| CVE-2026-109197 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all vers | HIGH | 7.5 | 38%ile | NVD | 2026-10-31 |
| CVE-2026-74993 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer a | HIGH | 7.5 | — | NVD | 2026-11-02 |
| CVE-2026-9010 | Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters | HIGH | 7.5 | 30%ile | Microsoft | 2026-05-12 |
| CVE-2026-11587 | SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database | HIGH | 7.2 | 18%ile | NVD | 2026-10-29 |
| CVE-2026-63224 | OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV cr | HIGH | 7.2 | 27%ile | NVD | 2026-10-30 |
| CVE-2026-116812 | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows pr | HIGH | 7.1 | 14%ile | NVD | 2026-10-27 |
| CVE-2026-116813 | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-re | HIGH | 7.1 | 14%ile | NVD | 2026-10-27 |
| CVE-2026-116821 | YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into S | HIGH | 7.1 | 20%ile | NVD | 2026-10-27 |
| CVE-2026-111503 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an | HIGH | 7.1 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-116807 | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping | HIGH | 7.0 | 19%ile | NVD | 2026-10-27 |
| CVE-2026-57190 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2 | HIGH | 7.0 | 52%ile | NVD | 2026-10-27 |
| CVE-2026-116820 | YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers t | MEDIUM | 6.9 | 14%ile | NVD | 2026-10-27 |
| CVE-2026-116828 | YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed | MEDIUM | 6.9 | 16%ile | NVD | 2026-10-27 |
| CVE-2026-120441 | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unaut | MEDIUM | 6.9 | — | NVD | 2026-11-02 |
| CVE-2026-77881 | Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated | MEDIUM | 6.9 | — | NVD | 2026-11-02 |
| CVE-2026-104694 | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before u | MEDIUM | 6.8 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-111027 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it | MEDIUM | 6.8 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-115281 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute bef | MEDIUM | 6.8 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-108308 | Tanium addressed a SQL injection vulnerability in Patch. | MEDIUM | 6.5 | 29%ile | NVD | 2026-10-27 |
| CVE-2026-116609 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and si | MEDIUM | 6.5 | 27%ile | NVD | 2026-10-28 |
| CVE-2026-116750 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' pa | MEDIUM | 6.5 | 18%ile | NVD | 2026-10-28 |
| CVE-2026-76005 | The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attri | MEDIUM | 6.5 | 21%ile | NVD | 2026-10-28 |
| CVE-2026-118192 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inj | MEDIUM | 6.5 | 38%ile | NVD | 2026-10-29 |
| CVE-2026-118698 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inj | MEDIUM | 6.5 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-115820 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generi | MEDIUM | 6.5 | 36%ile | NVD | 2026-10-30 |
| CVE-2025-9462 | The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up | MEDIUM | 6.5 | 24%ile | NVD | 2026-10-31 |
| CVE-2026-15272 | The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' paramet | MEDIUM | 6.5 | 25%ile | NVD | 2026-10-31 |
| CVE-2026-118871 | SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL inje | MEDIUM | 6.5 | — | NVD | 2026-11-02 |
| CVE-2026-87085 | Tanium addressed a SQL injection vulnerability in Provision. | MEDIUM | 6.3 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-119554 | Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injectio | MEDIUM | 6.0 | 12%ile | NVD | 2026-10-30 |
| CVE-2026-117513 | A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the fil | MEDIUM | 5.5 | 18%ile | NVD | 2026-10-27 |
| CVE-2026-117514 | A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the | MEDIUM | 5.5 | 36%ile | NVD | 2026-10-27 |
| CVE-2026-117515 | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impa | MEDIUM | 5.5 | 36%ile | NVD | 2026-10-27 |
| CVE-2026-117516 | A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the | MEDIUM | 5.5 | 36%ile | NVD | 2026-10-27 |
| CVE-2026-119619 | A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This aff | MEDIUM | 5.5 | 26%ile | NVD | 2026-10-30 |
| CVE-2026-120342 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of | MEDIUM | 5.5 | — | NVD | 2026-11-02 |
| CVE-2026-120347 | A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Co | MEDIUM | 5.5 | — | NVD | 2026-11-02 |
| CVE-2026-101325 | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up | MEDIUM | 5.3 | 17%ile | NVD | 2026-10-31 |
| CVE-2026-119301 | Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SD | MEDIUM | 5.0 | — | NVD | 2026-11-02 |
| CVE-2026-86386 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | MEDIUM | 4.3 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-115224 | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popu | MEDIUM | 4.1 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-117572 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter befor | MEDIUM | 4.1 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-6638 | PostgreSQL REFRESH PUBLICATION allows SQL injection via table name | LOW | 3.7 | 8%ile | Microsoft | 2026-05-12 |
| CVE-2026-86401 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | LOW | 2.7 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-90719 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | LOW | 2.7 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-90723 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | LOW | 2.7 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-90724 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions | LOW | 2.7 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-119427 | phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use | LOW | 2.3 | 13%ile | NVD | 2026-10-30 |
| CVE-2026-119562 | phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supply | LOW | 2.3 | 7%ile | NVD | 2026-10-30 |
| CVE-2026-116515 | A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown cod | LOW | 2.1 | 16%ile | NVD | 2026-10-26 |
| CVE-2026-114364 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. | UNKNOWN | — | — | NVD | 2026-11-02 |
| CVE-2026-114625 | Security Advisory 0199 | UNKNOWN | — | 64%ile | Arista | 2026-10-21 |
| CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | UNKNOWN | — | 38%ile | Microsoft | 2026-05-12 |
| CVE-2026-41889 | pgx: SQL Injection via placeholder confusion with dollar quoted string literals | UNKNOWN | — | 29%ile | Microsoft | 2026-05-12 |
| FG-IR-26-178 | Multiple Arbitrary File Read/Write via SQL Injection | UNKNOWN | — | — | Fortinet | 2026-10-13 |
| FG-IR-26-184 | SQL command injection in webmail | UNKNOWN | — | — | Fortinet | 2026-10-13 |