cbcvebase.

Microsoft Sql Server 2019 vulnerabilities

224 known vulnerabilities affecting microsoft/microsoft_sql_server_2019.

Total CVEs
224
CISA KEV
0
Public exploits
0
Exploited in wild
2
Severity breakdown
CRITICAL6HIGH186MEDIUM32

Vulnerabilities

Page 11 of 12
CVE-2026-77485P3HIGHCVSS 7.0≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-77485 [HIGH] CWE-416 CVE-2026-77485: Use after free in SQL Server allows an authorized attacker to elevate privileges locally. Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-36785P3HIGHCVSS 7.8≥ 15.0.0, < 15.0.2104.1≥ 15.0.0, < 15.0.4326.12023-10-10
CVE-2023-36785 [HIGH] CWE-191 CVE-2023-36785: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-36730P3HIGHCVSS 7.8≥ 15.0.0, < 15.0.2104.1≥ 15.0.0, < 15.0.4326.12023-10-10
CVE-2023-36730 [HIGH] CWE-122 CVE-2023-36730: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-36420P3HIGHCVSS 7.8≥ 15.0.0, < 15.0.2104.1≥ 15.0.0, < 15.0.4326.12023-10-10
CVE-2023-36420 [HIGH] CWE-415 CVE-2023-36420: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-37966P3HIGHCVSS 7.1≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-37966 [HIGH] CWE-125 CVE-2024-37966: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
nvd
CVE-2026-88088P3HIGHCVSS 7.0≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-88088 [HIGH] CWE-190 CVE-2026-88088: Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges loc Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85876P3HIGHCVSS 7.0≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-85876 [HIGH] CWE-416 CVE-2026-85876: Use after free in SQL Server allows an authorized attacker to elevate privileges locally. Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70189P3MEDIUMCVSS 6.7≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-70189 [MEDIUM] CWE-122 CVE-2026-70189: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
nvd
CVE-2026-88089P3MEDIUMCVSS 6.7≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-88089 [MEDIUM] CWE-20 CVE-2026-88089: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
nvd
CVE-2023-21718P3HIGHCVSS 7.8≥ 15.0.0, < 15.0.4280.7≥ 15.0.0, < 15.0.2101.72023-02-14
CVE-2023-21718 [HIGH] CWE-191 CVE-2023-21718: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-67633P3MEDIUMCVSS 6.5≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-67633 [MEDIUM] CWE-125 CVE-2026-67633: Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-69562P3MEDIUMCVSS 6.5≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-69562 [MEDIUM] CWE-125 CVE-2026-69562: Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a netw Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-88085P3MEDIUMCVSS 6.4≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-88085 [MEDIUM] CWE-122 CVE-2026-88085: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-78441P3MEDIUMCVSS 6.5≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-78441 [MEDIUM] CWE-125 CVE-2026-78441: Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-88084P4MEDIUMCVSS 5.3≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-88084 [MEDIUM] CWE-770 CVE-2026-88084: Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-68785P3MEDIUMCVSS 4.9≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-68785 [MEDIUM] CWE-122 CVE-2026-68785: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-77488P4MEDIUMCVSS 5.5≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-77488 [MEDIUM] CWE-191 CVE-2026-77488: Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose infor Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
nvd
CVE-2025-47997P4MEDIUMCVSS 5.3≥ 15.0.0.0, < 15.0.4445.1≥ 15.0.0, < 15.0.2145.12025-09-09
CVE-2025-47997 [MEDIUM] CWE-200 CVE-2025-47997: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL S Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-94520P4MEDIUMCVSS 4.9≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-94520 [MEDIUM] CWE-134 CVE-2026-94520: Use of externally-controlled format string in SQL Server allows an authorized attacker to deny servi Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-67628P4MEDIUMCVSS 4.9≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-67628 [MEDIUM] CWE-125 CVE-2026-67628: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
← Previous11 / 12Next →