#sql-injection
4 articles
CVE-2026-110697: Cross-Tenant Token Theft in Red Hat Quay
The robot account listing in Red Hat Quay builds a SQL LIKE pattern from namespace names without escaping. An attacker can retrieve other tenants' robot tokens and operate on their images...
CVE-2026-121653: SQL Injection Leading to RCE in Ivanti Endpoint Manager
SQL injection in the Core server of Ivanti Endpoint Manager before 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution. Update EPM to 2024 SU8...
CVE-2026-108474: SQL Injection in JetBrains Exposed (Kotlin)
In the JetBrains Exposed library (a SQL framework for Kotlin) before 1.5.1, SQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-27681: Critical SQL Injection Vulnerability in SAP Business Planning and Consolidation and SAP Business
Critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse allows data manipulation, service disruption, and potential system compromise. Affects versions HANABPC 810, BPC4HANA 300, SAP_BW 750-758, 816.