CVE-2026-81656

HighCVSS 8.8/10Last modified Oct 6, 2026

Description

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-816579.8IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deseriali CVE-2026-816586.5A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template CVE-2026-816597.1Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that CVE-2026-81665.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. CVE-2026-816608.8The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to s CVE-2026-816628.6Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration valu CVE-2026-816645.3The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/*CVE-2026-816657.5A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast CVE-2026-816666.5An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can CVE-2026-816685.4A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filte CVE-2026-816697.2IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticate CVE-2026-81676.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8