Topic

SQL Injection: news, advisories and analysis

19 articlesUpdated 29 Oct 2026

CyberSecureToday covers SQL Injection across 19 articles published between 4 Sep 2026 and 29 Oct 2026. The coverage includes 19 vulnerability advisories. 19 advisories are rated critical or high severity, and 4 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on SQL Injection most often intersect with Security Advisory, Patch & Fix and Vulnerability Analysis, with Technology, Cloud & SaaS the most affected sector. The most recent story, “This vulnerability exists in the Radius Xenia M2M SQL Injection Flaw Disclosed”, was published 29 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
This vulnerability exists in the Radius Xenia M2M SQL Injection Flaw Disclosed
CVE-2026-114358 in This vulnerability exists in the Radius Xenia M2M (SQL Injection) allows remote attackers to trigger arbitrary code execution. Patch: Ve
Aisha Noor29 Oct 202610 min read
ThreatsCloud & SaaSCritical
VeloCloud Orchestrator (VCO) on-prem has a securit SQL Injection Flaw Disclosed
CVE-2026-114625 in VeloCloud Orchestrator (VCO) on-prem has a securit (SQL Injection) allows remote attackers to trigger arbitrary code execution. Patch: V
Aisha Noor23 Oct 202610 min read
ThreatsCloud & SaaSHigh
Mem0 SQL Injection Flaw Disclosed
CVE-2026-115324 in Mem0 (SQL Injection) allows remote attackers to trigger arbitrary code execution. Patch: Version 1.0.8 and later.
Aisha Noor22 Oct 202610 min read
ThreatsCloud & SaaSCritical
Improper Neutralization of Special Elements used i SQL Injection Flaw Disclosed
CVE-2026-109894 in Improper Neutralization of Special Elements used i (SQL Injection) allows remote attackers to trigger arbitrary code execution. Patch: V
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSHigh
Azure Enterprise Services SQL Injection Flaw Disclosed
CVE-2026-62895 in Azure Enterprise Services (SQL Injection) allows remote attackers to trigger arbitrary code execution. Patch: Vendor security patch relea
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
Critical SQL Injection in IBM Cloud Portal Infrastructure Allowed Database Exfiltration
A critical SQL injection flaw on an enterprise IBM Cloud portal enabled unauthenticated remote attackers to extract backend database records.
Daniel Okafor18 Oct 202613 min read
ThreatsCloud & SaaSCritical
TSG Profleet Fleet Management SQL Injection Flaw Disclosed
An SQL injection vulnerability has been discovered in TSG Profleet.
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Green Popups WordPress Plugin SQL Injection Flaw Disclosed
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Amelia Booking Plugin SQL Injection Puts WordPress Sites at Risk
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Ivanti Endpoint Manager SQL Injection Enables Unauthenticated Code Execution
Ivanti patches critical SQL injection vulnerability CVE-2026-89310 in Endpoint Manager Core Server enabling unauthenticated remote code execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Abandoned Cart Pro SQL Injection Exposes WooCommerce Customer Records
Tyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Mei-Lin Chen14 Oct 20268 min read
NewsCloud & SaaSCritical
ChromaDB Vector Database Vulnerability Enables Unauthenticated Metadata Filter SQL Injection and Host Takeover (CVE-2026-78110)
ChromaDB patches a critical vulnerability (CVE-2026-78110) in vector metadata filtering that allows unauthenticated remote attackers to execute arbitrary code.
CST Editorial Desk12 Oct 20268 min read
ThreatsCloud & SaaSCritical
LiteLLM Gateway SQL Injection Vulnerability in Vector Search Metadata Filter Allows Backend Database Takeover
A critical SQL injection flaw in LiteLLM Proxy's vector metadata filtering allows unauthenticated API consumers to execute arbitrary PostgreSQL queries.
CST Editorial Desk10 Oct 20268 min read
ThreatsIndustrial & OTCritical
Ground-Station Telemetry Interface Socket.IO Vulnerability Enables Unauthenticated Database Injection and Takeover (CVE-2026-103244)
An authentication bypass and SQL injection in ground-station before v0.8.0 allows remote attackers to plant admin accounts and seize telemetry consoles.
Priya Raman1 Oct 202611 min read
ThreatsCloud & SaaSCritical
LiteLLM Pre-Authentication SQL Injection Flaw Exposes Enterprise Master Keys and AI Model Routing Gateways
LiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
CST Editorial Desk20 Sep 202614 min read
ThreatsCloud & SaaSCritical
WordPress Core Critical SQL Injection Flaw CVE-2026-60137 Exploited in Mass Web Attacks
CISA incorporates WordPress Core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (CVSS 9.8) into KEV catalog following active in-the-wild web attacks.
CST Editorial Desk17 Sep 202614 min read
ThreatsCloud & SaaSCritical
Metabase Business Intelligence SQL Injection Flaw Exploited to Breach Analytics Warehouses
CISA alerts enterprises to active exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase analytics dashboards allowing database exfiltration.
CST Editorial Desk16 Sep 20269 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway Critical SQL Injection Flaw Weaponized in Active Attacks
CISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSHigh
Enterprise app CVE roundup: PeopleSoft, cPanel, Artifactory and Switchvox all need attention
Four high-severity vulnerabilities in widely deployed enterprise software — including a build-artefact repository that sits directly in the software supply chain.
Priya Raman4 Sep 20266 min read