Topic

Database Security: news, advisories and analysis

12 articlesUpdated 18 Oct 2026

CyberSecureToday covers Database Security across 12 articles published between 12 Sep 2026 and 18 Oct 2026. The coverage includes 12 vulnerability advisories. 12 advisories are rated critical or high severity, and 3 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Database Security most often intersect with HackerOne, Remote Code Execution and SQL Injection, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Critical SQL Injection in IBM Cloud Portal Infrastructure Allowed Database Exfiltration”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Critical SQL Injection in IBM Cloud Portal Infrastructure Allowed Database Exfiltration
A critical SQL injection flaw on an enterprise IBM Cloud portal enabled unauthenticated remote attackers to extract backend database records.
Daniel Okafor18 Oct 202613 min read
ThreatsCloud & SaaSHigh
MariaDB CONNECT Storage Engine Flaw Bypassed FILE Privilege and secure_file_priv Controls
Missing authorization checks in MariaDB CONNECT file UDFs allowed authenticated users with basic SELECT permissions to read and write arbitrary server files.
Daniel Okafor18 Oct 202613 min read
ThreatsBanking & FintechHigh
MariaDB DROP PACKAGE Defect Leaves Orphaned Grants in mysql.procs_priv Enabling Privilege Escalation
A catalog cleanup omission in MariaDB's PL/SQL package engine left orphaned grants in mysql.procs_priv, allowing low-privilege users to hijack administrative packages.
CST Editorial Desk18 Oct 202613 min read
ThreatsCloud & SaaSCritical
MariaDB Critical RCE Chain Exploits SYS_REFCURSOR Use-After-Free and ST_Area Over-Read
A critical exploit chain in MariaDB combined a cursor-array use-after-free with a geospatial memory disclosure to achieve command execution from low-privilege accounts.
CST Editorial Desk18 Oct 202616 min read
ThreatsCloud & SaaSCritical
Abandoned Cart Pro SQL Injection Exposes WooCommerce Customer Records
Tyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Mei-Lin Chen14 Oct 20268 min read
ThreatsCloud & SaaSHigh
AWS pgcollection Type Confusion Flaw Enables Remote Code Execution in PostgreSQL
AWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon OpenSearch SQL Plugin Cursor Deserialization Flaw Enables Remote Code Execution CVE-2026-83497
AWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Azure Cosmos DB Injection Flaw Enabled Cloud Privilege Escalation
Microsoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
CST Editorial Desk23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Microsoft SQL Server Memory Corruption RCE Flaw Exploited in Database Infiltration Attacks
CISA adds Microsoft SQL Server vulnerability CVE-2019-1068 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against enterprise database clusters.
CST Editorial Desk17 Sep 202614 min read
ThreatsCloud & SaaSCritical
Oracle E-Business Suite Critical Privilege Escalation Flaw CVE-2026-46817 Exploited in Enterprise Intrusions
CISA adds Oracle E-Business Suite privilege management flaw CVE-2026-46817 (CVSS 9.8) to its KEV catalog following active exploitation against cloud ERP deployments.
Priya Raman16 Sep 202611 min read
ThreatsCloud & SaaSCritical
Metabase Business Intelligence SQL Injection Flaw Exploited to Breach Analytics Warehouses
CISA alerts enterprises to active exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase analytics dashboards allowing database exfiltration.
CST Editorial Desk16 Sep 20269 min read
ThreatsCloud & SaaSHigh
PostGREShell: 12-year-old PostgreSQL logical replication flaw CVE-2026-6471 enables remote code execution
Security researchers disclose PostGREShell, a flaw present since PostgreSQL 9.4 that lets users with the REPLICATION attribute execute arbitrary code on database hosts.
Tom Verhoeven12 Sep 20266 min read