ROS-20261002-73-0076

The vulnerability of the pgrestoreattributestats function in the PostgreSQL database management system is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0004

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0011

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0031

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0032

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0033

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0035

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2026-82039: Improper Neutralization of Special Elements used in an SQL Command

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

CVE-2026-104055: Insertion of Sensitive Information into Log File

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

ROS-20261002-73-0065

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0106

The vulnerability of the amcheck extension in the PostgreSQL database management system is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code by manipulating the searchpath parameter...

ROS-20261002-73-0092

The vulnerability of the ECPG client of the PostgreSQL database management system is related to a countable loss of significance. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending an incorrect bytea value...

ROS-20261002-73-0114

The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...

ROS-20261002-73-0079

The vulnerability of DDL commands in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to cause service interruptions remotely...

ROS-20261002-73-0121

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20261002-73-0098

The vulnerability of the GSSAPI component in the PostgreSQL database management system is related to the lack of integrity checks during the transmission of messages through the communication channel. Exploiting this vulnerability allows a malicious actor to carry out “man-in-the-middle” attacks...

ROS-20261002-73-0103

The vulnerability of the picksplit function in the PostgreSQL database management system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by the system...

ROS-20261002-73-0117

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20261002-73-0110

The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0091

The vulnerability of the ascii function in the PostgreSQL database management system is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...