Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,099 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15736 |
high | 8.3 | 0.0038 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: I | |
CVE-2026-60582 |
high | 8.3 | 0.0038 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite ( | |
CVE-2026-61654 |
high | 8.3 | — | 2026-10-29 | Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, t | |
CVE-2026-24031 |
high | 8.2 | 0.0040 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This | |
CVE-2026-34747 |
high | 8.2 | 0.0032 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, certa | |
CVE-2026-8726 |
high | 8.2 | 0.0044 | 2026-05-19 | The extension fails to properly sanitize user input before using it in a database query. As a result | |
CVE-2026-8827 |
high | 8.2 | 0.0033 | 2026-05-19 | The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing | |
CVE-2026-65877 |
high | 8.2 | 0.0038 | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improp | |
CVE-2026-39340 |
high | 8.1 | 0.0023 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability | |
CVE-2026-5785 |
high | 8.1 | 0.0139 | 2026-04-16 | Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions fro | |
CVE-2026-31952 |
high | 8.1 | 0.0025 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-41496 |
high | 8.1 | 0.0035 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents versio | |
CVE-2026-29206 |
high | 8.1 | 0.0031 | 2026-05-13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections | |
CVE-2026-56287 |
high | 8.1 | 0.0065 | 2026-07-15 | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/ | |
CVE-2026-57821 |
high | 8.1 | 0.0074 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in | |
CVE-2026-63231 |
high | 8.1 | 0.0045 | 2026-07-29 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker t | |
CVE-2026-17543 |
high | 8.1 | 0.0033 | 2026-07-30 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injecti | |
CVE-2026-52521 |
high | 8.1 | 0.0040 | 2026-08-03 | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary | |
CVE-2026-70049 |
high | 8.0 | 0.0266 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Co | |
CVE-2026-35069 |
high | 8.0 | 0.0023 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Specia | |
CVE-2026-13752 |
high | 8.0 | 0.0033 | 2026-06-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL | |
CVE-2026-65673 |
high | 7.8 | 0.0032 | 2026-08-11 | Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate pri | |
CVE-2026-32167 |
high | 7.8 | 0.0030 | 2026-04-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2026-32176 |
high | 7.8 | 0.0025 | 2026-04-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2026-17418 |
high | 7.8 | 0.0030 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service | |
CVE-2026-32271 |
high | 7.7 | 0.0048 | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 th | |
CVE-2026-46359 |
high | 7.7 | 0.0026 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allow | |
CVE-2026-56689 |
high | 7.7 | 0.0037 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special E | |
CVE-2026-64636 |
high | 7.7 | 0.0040 | 2026-08-07 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authe | |
CVE-2026-54455 |
high | 7.6 | 0.0025 | 2026-10-28 | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and h | |
CVE-2026-42646 |
high | 7.6 | 0.0023 | 2026-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-45213 |
high | 7.6 | 0.0023 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-52712 |
high | 7.6 | 0.0023 | 2026-06-16 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. | |
CVE-2026-56052 |
high | 7.6 | 0.0038 | 2026-06-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57631 |
high | 7.6 | 0.0038 | 2026-06-26 | Administrator SQL Injection in Popup box <= 6.0.1 versions. | |
CVE-2026-57773 |
high | 7.6 | 0.0038 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-61955 |
high | 7.6 | 0.0038 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-65462 |
high | 7.6 | 0.0038 | 2026-07-23 | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | |
CVE-2026-65532 |
high | 7.6 | 0.0038 | 2026-07-23 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
CVE-2026-59537 |
high | 7.6 | 0.0038 | 2026-07-27 | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer | |
CVE-2026-66427 |
high | 7.6 | 0.0038 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | |
CVE-2026-73346 |
high | 7.6 | 0.0038 | 2026-08-13 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | |
CVE-2026-65822 |
high | 7.6 | 0.0046 | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, | |
CVE-2026-61569 |
high | 7.5 | 0.0028 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/l | |
CVE-2026-93855 |
high | 7.5 | 0.0041 | 2026-10-29 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'su | |
CVE-2026-93904 |
high | 7.5 | 0.0046 | 2026-10-29 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vul | |
CVE-2026-47296 |
high | 7.5 | 0.0069 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2025-65877 |
high | 7.5 | 0.0030 | 2025-12-02 | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL | |
CVE-2026-22743 |
high | 7.5 | 0.0026 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpr | |
CVE-2026-33614 |
high | 7.5 | 0.0034 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the |