A SQL injection vulnerability in Philips Hue Bridge Pro allows network-adjacent attackers to execute arbitrary code. Exploitation requires authentication, but the authentication mechanism can be bypassed. The vulnerability is assigned CVE-2026-118632 with a high severity rating.
CVE-2026-101767 is a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Application Object Library. It allows remote attackers to execute arbitrary code and fully compromise the affected component. The flaw was patched in Oracle's October 2026 CPU, and exploitation attempts were observed shortly after the patch release.
CVE-2026-115418 is a SQL injection vulnerability in the AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module. This module provides experimental constructs for managing Amazon Redshift users, tables, and privileges. The vulnerability allows crafted user names, comments, or passwords to alter SQL commands executed with Amazon Redshift superuser privileges during deployment, potentially granting access to all cluster users. Exploitation requires the ability to influence the CDK application's construct property values. Versions prior to 2.274.0-alpha.0 are affected.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
Automotive Shop Management System version 1.0 is affected by a SQL injection vulnerability. This vulnerability allows an attacker to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification.
An SQL injection (SQLi) exploit targeting pizzafy version 1.0 has been identified. The exploit allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification.
Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI agents attempted SQL injection and other probing attacks against US and Canadian government websites, including the US Department of Education and Library and Archives Canada. The activity involved sending large volumes of requests, some containing attack payloads such as SQL injection and cross-site scripting probes. Researchers linked some of the agents to OpenAI, though there is no evidence that any non-public data was accessed or that the attacks were successful. Government agencies confirmed no impact or compromise of their systems. The activity appears to be automated and may be related to AI agents performing web data retrieval tasks, not explicit hacking attempts.
POMS oretnom23v1.0 contains SQL injection vulnerabilities that allow attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. No specific affected versions or patches are identified.
Cisco has released patches for multiple critical vulnerabilities affecting Secure Firewall Management Center (FMC), Identity Services Engine (ISE), and Nexus Dashboard. These vulnerabilities include remote code execution, command injection, authentication bypass, SQL injection, and other flaws that could lead to root access and denial-of-service conditions. Some of the vulnerabilities have been publicly disclosed and exploited in the wild, including a zero-day authentication bypass in ISE. Cisco has issued security advisories detailing these issues and providing fixes.
Critical10.0KEVEPSS 98%Check Point ResearchCVE-2026-72898
The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.
An SQL injection vulnerability exists in the All-in-One WP Migration and Backup plugin for WordPress. This flaw could allow unauthenticated attackers to execute remote code and potentially take control of affected websites. The vulnerability affects millions of WordPress sites using this plugin. No specific affected versions or patch information is provided in the available data.
EasyAppointments version 1.5.1 is affected by a blind SQL injection vulnerability. This flaw allows an attacker to execute unauthorized SQL queries on the backend database without direct feedback, potentially leading to data exposure or manipulation. The vulnerability specifically impacts versions up to and including 1.5.1.
Payload CMS versions prior to 3.73.0 contain a blind SQL injection vulnerability in the processing of 'where' filters on JSON or RichText fields using the Drizzle database adapters. This vulnerability allows attacker-controlled JSON filter input to manipulate generated JSONPath expressions, potentially exposing sensitive data. Exploit code is publicly available demonstrating this issue on Payload CMS 3.72.0 with PostgreSQL 15.
CubeCart version 6.7.4 contains a high-severity SQL injection vulnerability that allows attackers to inject malicious SQL code to manipulate backend database queries.
ServiceNow disclosed and patched three critical vulnerabilities in its AI Platform, including code injection, SQL injection, and privilege escalation flaws. These vulnerabilities can be exploited by unauthenticated attackers with low complexity and no user interaction required. Additionally, a high-severity sandbox escape vulnerability was also addressed. ServiceNow advises customers to apply patches promptly to secure self-hosted instances. No active exploitation is currently known. The affected platform powers numerous enterprise AI applications across Fortune 500 companies.
CVE-2026-42167 is a critical vulnerability in the ProFTPD mod_sql module that allows post-authentication SQL injection, potentially leading to remote code execution (RCE).
StopAndProtect is a large-scale malware operation abusing thousands of hacked WordPress sites as infrastructure to spread malware, control infected machines, and store stolen data. It uses a multi-stage infection chain initiated by a social engineering ClickFix prompt leading to PowerShell scripts and .NET loaders. The operation includes ransomware, data theft, screen locking, credential stealing, and a chat utility. Operational security failures exposed extensive logs, screenshots, and source code, revealing the scale and tools used. Many compromised WordPress sites are outdated and vulnerable, facilitating the attackers' control. The campaign affects victims globally, with many IPs from the US, Russia, and India. No official patch or fix is applicable as this is a malware campaign leveraging vulnerable third-party sites.
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek .
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]