sql_server_2017 vulnerabilities
CVEs whose affected-version data names the sql_server_2017 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
42 CVEsRSS
CVE-2026-67384High· 8.8Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67381High· 8.8Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-67380High· 8.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67376High· 7.5Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
CVE-2026-67370High· 8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-67368High· 8.8Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66820High· 8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66819High· 8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66818High· 8.8Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66814High· 8.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-47296High· 7.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-21262High· 8.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.