Known Exploited Vulnerabilities August 11, 2026 · CISA KEV Catalog

CVE-2026-72898: Metabase SQL Injection Vulnerability

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-72898 Metabase
Related: CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability Known Exploited Vulnerabilities · Nov 12, 2024
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026