Occurred Aug 11, 2026, 12:00:00 AM UTC

First published Oct 27, 2026, 8:20:16 PM UTC · Last updated Oct 27, 2026, 8:20:16 PM UTC

CVE-2026-72898: Metabase SQL Injection Vulnerability

Reported by CISA Known Exploited Vulnerabilities

The source reports that CVE-2026-72898 allows unauthenticated remote SQL injection in Metabase, potentially enabling administrator access and access to connected database data. It directs users to apply mitigations according to vendor instructions.

Share this event

Follow: Events in United States

Manage follows

Why it matters

The reported vulnerability may expose Metabase instances and data accessible through connected databases.

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 4/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-72898: Metabase SQL Injection Vulnerability

Report an issue

Read our editorial process and corrections policy.

Continue exploring

Related developments reported in the last 30 days. These are not necessarily ongoing incidents.

Same topic
NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography StandardsOct 27, 2026, 12:00 PM UTC
The report describes timelines and migration activities for federal agencies. It is presented as a resource for technology providers and organizations developing quantum-readiness road maps.
Same topic
CVE-2026-111497: Google Brotli Unchecked Return Value VulnerabilityOct 27, 2026, 12:00 AM UTC
The source describes an unchecked return value vulnerability in Google Brotli that could allow memory disclosure, denial of service, or potentially arbitrary code execution through a crafted compressed stream. It calls for mitigations following vendor instructions and applicable CISA guidance.
Same topic
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityOct 27, 2026, 12:00 AM UTC
The vulnerability in Adobe Commerce and Magento could allow arbitrary code execution and elevated access to a user's account or session. The source advises applying vendor mitigations, or discontinuing use if they are unavailable.
Same topic
CVE-2026-109618: PHP Memory Corruption VulnerabilityOct 26, 2026, 12:00 AM UTC
The source describes a PHP memory corruption vulnerability that allows unauthenticated remote code execution and calls for mitigations under vendor instructions. It also directs stakeholders to assess internet exposure and follow applicable CISA guidance.
Same topic
CVE-2026-109619: PHP Stale Internal Request-State VulnerabilityOct 26, 2026, 12:00 AM UTC
The source describes a PHP vulnerability that permits unauthenticated remote code execution and calls for mitigations following vendor instructions. It also advises evaluating internet exposure and applying relevant CISA patching guidance.
Same topic
TfL disruption — Bakerloo LineOct 25, 2026, 4:27 PM UTC
Severe delays are reported on the Bakerloo Line while a signal failure is being fixed. Tickets are accepted on specified bus and rail services via any reasonable route.

Loading related developments…

Explore events in united states