CVE Watch412,870 in full archive

Vulnerabilities exploitable today

412,870in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,779

New KEV · 24H0

Exploit Today ≥ 701,703

Distribution · last window

Critical
5,666
High
22,249
Medium
20,641
Low
2,127

Filters

Window

Severity

Flags

Vulnerabilities412,481–412,520 · 412,870

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1181208.8 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181198.0 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181188.0 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181178.0 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181167.0 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.10h CVE-2026-1181157.5 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-11418—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26d CVE-2017-1867—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24d CVE-2026-1181147.5 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2017-3173—

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181128.0 HIG

—

——0Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2020-11373—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none24d CVE-2026-125121—

—

——0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.13h CVE-2026-125122—

—

——0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.13h CVE-2026-1181098.8 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181087.5 HIG

—

——0Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181068.1 HIG

—

——0Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.10h CVE-2026-1181058.8 HIG

—

——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1181046.5 MED

—

——0Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.10h CVE-2026-1169437.5 HIG

—

——0Buffer over-read in SQL Server allows an unauthorized attacker to disclose information over a network.10h CVE-2026-1169428.8 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169418.8 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169404.9 MED

—

——0Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.10h CVE-2026-1169395.7 MED

—

——0Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.10h CVE-2026-1169387.5 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169377.5 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169348.8 HIG

—

——0Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1169337.2 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169326.5 MED

—

——0Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.10h CVE-2025-6046—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26d CVE-2025-61631—

—

——0Rejected reason: Not used26d CVE-2026-1169317.5 HIG

—

——0Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.10h CVE-2026-1169308.8 HIG

—

——0Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.10h CVE-2026-1169297.5 HIG

—

——0Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1169289.8 CRI

—

——0Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.10h CVE-2026-1169278.8 HIG

—

——0Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.10h CVE-2026-1169267.5 HIG

—

——0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.10h CVE-2026-1167216.5 MED

—

——0Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.10h CVE-2025-8395—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26d