Vulnerabilities (CVE)

Filtered by vendor Microsoft Subscribe
Filtered by product Sql Server 2025
Total 67 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2026-47295 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-07-22 N/A 8.8 HIGH
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-21262 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-07-10 N/A 8.8 HIGH
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-40370 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-06-18 N/A 8.8 HIGH
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-32176 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-06-17 N/A 6.7 MEDIUM
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-32167 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-06-17 N/A 6.7 MEDIUM
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-26116 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-06-17 N/A 8.8 HIGH
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-26115 1 Microsoft 5 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 2 more 2026-06-17 N/A 8.8 HIGH
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.