CVE-2026-77874

HighCVSS 8.6/10Last modified Sep 24, 2026

Description

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 24, 2026
Last modified
Sep 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-778756.8The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundarCVE-2026-778768.8Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel moCVE-2026-778777.8Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach theCVE-2026-778787.8Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore rouCVE-2026-778797.1Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_tCVE-2026-77887.3A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is thCVE-2026-778807.8Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change routCVE-2026-778815.5Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route tCVE-2026-778827.8A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execCVE-2026-778834.9Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for DerCVE-2026-778847.1Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCVE-2026-778867.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.