Microsoft Sql Server 2019 vulnerabilities
194 known vulnerabilities affecting microsoft/sql_server_2019.
Total CVEs
194
CISA KEV
0
Public exploits
0
Exploited in wild
1
Severity breakdown
CRITICAL7HIGH163MEDIUM24
Vulnerabilities
Page 10 of 10
CVE-2026-68780P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-68780 [MEDIUM] CWE-125 CVE-2026-68780: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-67630P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-67630 [MEDIUM] CWE-125 CVE-2026-67630: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-67645P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-67645 [MEDIUM] CWE-125 CVE-2026-67645: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2024-49043P3HIGHCVSS 7.8≥ 15.0.2000.5, < 15.0.2130.3≥ 15.0.4003.23, < 15.0.4410.12024-11-12
CVE-2024-49043 [HIGH] CWE-426 CVE-2024-49043: Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
nvd
CVE-2026-77485P3HIGHCVSS 7.0fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-77485 [HIGH] CWE-416 CVE-2026-77485: Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-37966P3HIGHCVSS 7.1≥ 15.0.2000.5, < 15.0.2120.1≥ 15.0.4003.23, < 15.0.4390.22024-09-10
CVE-2024-37966 [HIGH] CWE-125 CVE-2024-37966: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
nvd
CVE-2026-67633P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-67633 [MEDIUM] CWE-125 CVE-2026-67633: Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-69562P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-69562 [MEDIUM] CWE-125 CVE-2026-69562: Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a netw
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-78441P3MEDIUMCVSS 6.5fixed in 15.0.2190.7≥ 15.0.4003.23, ≤ 15.0.4490.92026-09-08
CVE-2026-78441 [MEDIUM] CWE-125 CVE-2026-78441: Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a
Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-68785P3MEDIUMCVSS 4.9fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-68785 [MEDIUM] CWE-122 CVE-2026-68785: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-77488P4MEDIUMCVSS 5.5fixed in 15.0.2190.7≥ 15.0.4003.23, < 15.0.4490.92026-09-08
CVE-2026-77488 [MEDIUM] CWE-191 CVE-2026-77488: Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose infor
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
nvd
CVE-2025-47997P4MEDIUMCVSS 5.3≥ 15.0.2000.5, < 15.0.2145.1≥ 15.0.4003.23, < 15.0.4445.12025-09-09
CVE-2025-47997 [MEDIUM] CWE-200 CVE-2025-47997: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL S
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2024-37337P4MEDIUMCVSS 4.3≥ 15.0.2000.5, < 15.0.2120.1≥ 15.0.4003.23, < 15.0.4390.22024-09-10
CVE-2024-37337 [MEDIUM] CWE-197 CVE-2024-37337: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
nvd
CVE-2024-37342P4MEDIUMCVSS 4.3≥ 15.0.2000.5, < 15.0.2120.1≥ 15.0.4003.23, < 15.0.4390.22024-09-10
CVE-2024-37342 [MEDIUM] CWE-125 CVE-2024-37342: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
nvd
← Previous10 / 10