Fixes 52 records
Priority MEDIUM 45
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00974 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 43
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01694 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-502
Priority MEDIUM 42
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00819 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +2 CWE-122
Priority MEDIUM 42
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00819 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +2 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00819 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +2 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.00707 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-125
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Use after free in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-416
Priority MEDIUM 42
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority MEDIUM 42
Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.00707 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-822
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-89
Priority MEDIUM 42
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01024 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-59
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-89
Priority MEDIUM 42
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-89
Priority MEDIUM 41
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-284
Priority MEDIUM 41
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-1390
Priority MEDIUM 41
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-1220
Priority MEDIUM 41
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-284
Priority MEDIUM 41
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01174 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-190
Priority MEDIUM 41
Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-269
Priority MEDIUM 41
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00778 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-1220
Priority MEDIUM 40
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00663 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-121
Priority LOW 39
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01113 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-502
Priority LOW 36
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00333 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority LOW 32
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00264 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-416
Priority LOW 31
Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00922 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +2 CWE-125
Priority LOW 31
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-126
Priority LOW 31
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00922 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +2 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-908
Priority LOW 31
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-908
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01138 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-125
Priority LOW 31
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 15.0.4490.9, 15.0.2190.7 +4 CWE-125
Priority LOW 31
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-126
Priority LOW 31
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-126
Priority LOW 31
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00995 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-908
Priority LOW 27
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01124 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-122
Priority LOW 25
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00404 · Published 2026-09-08 · Fixed in 14.0.3550.4, 14.0.2130.4 +6 CWE-191