CVE-2026-25076

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise database.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-250778.8Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using th CVE-2026-25086.5The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to,CVE-2026-250838.7GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows CVE-2026-250849.8Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.CVE-2026-250859.8A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine i CVE-2026-250867.7Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send maliciou CVE-2026-250877.0Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when CVE-2026-250888.8An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6 CVE-2026-250899.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 th CVE-2026-25096.4The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes fiel CVE-2026-250998.8Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, w CVE-2026-251005.4Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload p