CVE-2026-108474 in JetBrains Exposed: SQL injection rated CVSS 9.8

JetBrains Exposed before 1.5.1 contains a SQL injection (CWE-89) rated CVSS 9.8: framework SQL functions fail to escape string arguments and the flaw is reachable without authentication. Version 1.5.1 fixes it; there is no confirmed exploitation in the wild or public proof of concept. The same October 2026 JetBrains batch patched TeamCity issues CVE-2026-106218 (8.8) and CVE-2026-106219 (6.5).

• CVSS 9.8 SQL injection in JetBrains Exposed before 1.5.1; fixed in 1.5.1
• Reachable without authentication when external input reaches SQL helpers
• No confirmed exploitation in the wild and no public proof of concept
• Same batch fixed TeamCity CVE-2026-106218 (8.8) and CVE-2026-106219 (6.5)