13986 matches found
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2026-19496
A flaw was found in sources-api-go. An authenticated remote user can exploit a SQL injection vulnerability by injecting arbitrary SQL expressions through query parameter filtering. This can lead to unauthorized information disclosure of internal database fields, arbitrary PostgreSQL function...
Important: Red Hat Security Advisory: postgresql-jdbc security update
An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
Important: Red Hat Security Advisory: postgresql-jdbc security update
An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Important: Red Hat Security Advisory: postgresql-jdbc security update
An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...
Important: Red Hat Security Advisory: postgresql-jdbc security update
An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Astra Linux – Vulnerability in PostgresSQL-15
Lack of validation for multibyte character lengths in PostgreSQL text manipulation allows a database user to execute crafted queries that lead to a buffer overflow. This enables the execution of arbitrary code as the operating system user running the database. Versions prior to PostgreSQL 18.2,...
Astra Linux – Vulnerability in PostgresSQL-15
A heap buffer overflow in PostgreSQL’s pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions prior to PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...
Astra Linux – Vulnerability in PostgresSQL-15
Lack of type validation for input in the PostgreSQL intarray extension’s selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...
Astra Linux – Vulnerability in PostgresSQL-15
Integer wraparound in several PostgreSQL libpq client library functions allows an application’s input provider or network peer to cause libpq to undersize allocations and write out-of-bounds data, involving hundreds of megabytes. This leads to a segmentation fault in the application that uses...
Astra Linux – Vulnerability in PostgresSQL-15
Improper validation of the “oidvector” type in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out the possibility of attacks where confidential information is included in the disclosed bytes, but such attacks seem unlikely. Versions of PostgreSQL pri...
Astra Linux – Vulnerability in PostgresSQL-15
Lack of authorization in the PostgreSQL CREATE STATISTICS command allows a table owner to perform denial of service against other users who also attempt to execute CREATE STATISTICS commands within the same schema. A subsequent execution of the CREATE STATISTICS command with the same name, by a...
Apache Superset < 4.0.2 - SQL Injection
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL
Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.2. Vulnerability Details CVEID:CVE-2026-13757 DESCRIPTION: A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a...
openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...
CVE-2026-48080
OpenReception OpenReception’s appointment-booking software (before v1.0.2) exposed a live PostgreSQL connection string via GET /api/tenants/{id} to any TENANT_ADMIN, including the databaseUrl containing the instance-wide superuser credentials and plaintext password. This allowed cross-tenant acce...
CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...
CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...