Threats affecting pkg:maven/microsoft/sql-server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.

CVE-2026-66819 is a high-severity SQL injection vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to elevate privileges over a network by improper neutralization of special elements in SQL commands. The vulnerability affects multiple versions prior to specific fixed builds. An official fix is available from Microsoft.

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-68779 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity). An official fix is available from Microsoft.

CVE-2026-68776 is a vulnerability in Microsoft SQL Server 2017 (CU 31) involving the use of an uninitialized resource. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. An official fix is available from Microsoft.

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Microsoft SQL Server Elevation of Privilege Vulnerability