35
30
30
30
45
30
Public PoC Released for Apache Superset SQL Injection Vulnerability
A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.
CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.
45
45
Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.
52
45
30
35
30
30
45
30
USN-8765-1: python-sql vulnerability
Ubuntu patches python-sql SQL injection flaw where values passed to unary operators are incorrectly escaped.
Ubuntu Security Notice USN-8765-1 fixes a vulnerability in python-sql discovered by Cedric Krier. The library incorrectly escaped values passed to unary operators, allowing an attacker to potentially perform SQL injection attacks against applications using the library.
18
30
30
Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection
Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.
Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.
45
[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.
Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.
45
30
35
30
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilitiesnew
Cisco fixed multiple authenticated SQL and HQL injection flaws in Identity Services Engine and ISE-PIC APIs allowing arbitrary database queries and unauthorized data access.
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE-PIC stem from insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated, remote attacker can send crafted requests to execute arbitrary SQL or HQL queries against the underlying database, viewing or modifying data they are not authorized to access. Cisco has released software updates.
30
CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search
Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.
CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.
30
CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Apache Syncope patches a moderate SQL injection (CVE-2026-77051) in Audit Events search via unsanitized entityKey and opEvent inputs.
CVE-2026-77051 is a moderate-severity SQL injection vulnerability in Apache Syncope's Audit Events search, caused by unsanitized entityKey and opEvent parameters. The flaw affects syncope-core-persistence-jpa 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the fixed versions in each affected line.
18
30
30
30
30
Cisco Identity Services Engine SQL Injection Vulnerabilitiesnew
Cisco released fixes for multiple SQL injection vulnerabilities in Identity Services Engine as part of its September 2026 advisory batch.
Multiple SQL injection vulnerabilities in Cisco Identity Services Engine (ISE) could allow a remote attacker to conduct SQL injection attacks against affected devices. Cisco has released software updates, and no workarounds address the flaws. The advisory is part of a group of advisories published in Cisco's September 2026 batch.
28
30
Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls
Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.
Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.
45
CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE
CISA advisory ICSMA-26-253-01 covers three NextGen Mirth Connect flaws, including SQL injection and XXE, with testing performed against version 4.5.2.
CISA has published ICS Medical Advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Mirth Connect, the open-source healthcare integration engine. The flaws include SQL injection and XML external entity (XXE) injection, tracked as CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578, with testing performed against version 4.5.2. The findings were announced on the oss-security mailing list by researcher Abhinav Agarwal on September 11.
45
NextGen Healthcare Mirth Connect
CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.
CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.
32
Microsoft: Windows Server 2025 changes causing app crashes
Microsoft warns Windows Server 2025 memory-management changes crash AWE apps, including SQL Server with Lock Pages in Memory; disable LPIM as workaround.
Microsoft confirmed a known issue where Windows Server 2025 memory-management changes cause access violations, memory corruption, or unexpected termination in applications using Address Windowing Extensions (AWE). SQL Server running with the Lock Pages in Memory (LPIM) policy is affected, with symptoms including 0xC0000005 access violations, DBCC CHECKDB failures, crash dumps, and services stopping or restarting unexpectedly. Microsoft's temporary workaround is to disable the LPIM policy for the SQL Server service account or disable AWE in other affected apps, with a permanent fix promised in a future Windows update.
32
35
30
30