Known vulnerabilities in Microsoft SQL Server

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:microsoft_sql_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 242
Public exploits: 2
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft SQL Server Microsoft SQL Server is affected by 242 known vulnerabilities: 4 critical, 131 high, 70 medium, 37 low Critical High Medium Low

Vulnerabilities (242)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148380 - Heap-based Buffer Overflow
CVE-2026-67388
CWE-122 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148379 - Use of Uninitialized Resource
CVE-2026-67386
CWE-908 Low
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148378 - Use After Free
CVE-2026-67385
CWE-416 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148377 - Integer overflow
CVE-2026-67384
CWE-190 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148376 - Information Exposure Through an Error Message
CVE-2026-67383
CWE-209 Low
No
No
17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148375 - Heap-based Buffer Overflow
CVE-2026-67381
CWE-122 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148374 - Heap-based Buffer Overflow
CVE-2026-67380
CWE-122 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148373 - Stack-based buffer overflow
CVE-2026-67379
CWE-121 Medium
No
No
15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148372 - Untrusted Pointer Dereference
CVE-2026-67378
CWE-822 Medium
No
No
15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148371 - Integer overflow
CVE-2026-67376
CWE-190 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148370 - Heap-based Buffer Overflow
CVE-2026-67373
CWE-122 Medium
No
No
17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148369 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-67370
CWE-89 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148368 - Out-of-bounds read
CVE-2026-67369
CWE-125 Low
No
No
17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148367 - Improper Link Resolution Before File Access ('Link Following')
CVE-2026-67368
CWE-59 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148366 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-66820
CWE-89 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148365 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-66819
CWE-89 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148364 - Improper Privilege Management
CVE-2026-66818
CWE-269 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148363 - Insufficient Logging
CVE-2026-66816
CWE-778 Low
No
No
16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148362 - Insufficient Granularity of Access Control
CVE-2026-66814
CWE-1220 Medium
No
No
14.0.2130.4, 14.0.3550.4, 15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917
#VU148361 - Deserialization of Untrusted Data
CVE-2026-47297
CWE-502 High
No
No
15.0.2190.7, 15.0.4490.9, 16.0.1200.5, 16.0.4275.2, 17.0.1135.8, 17.0.4085.5 09.09.2026 SB2026090917


Showing elements 1 - 20 out of 242