JLSEC-2026-53

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8...

CVE-2026-2004 affecting package postgresql for versions less than 16.12-1

CVE-2026-2004 affecting package postgresql for versions less than 16.12-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-2005 affecting package postgresql for versions less than 16.12-1

CVE-2026-2005 affecting package postgresql for versions less than 16.12-1. An upgraded version of the package is available that resolves this issue...

BIT-POSTGRESQL-2026-2005 PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

BIT-POSTGRESQL-2026-2003 PostgreSQL oidvector discloses a few bytes of memory

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8...

AZL-77643 CVE-2026-2006 affecting package rust 1.90.0-4

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12,...

CVE-2026-2003

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8...

AZL-77423 CVE-2026-2004 affecting package postgresql for versions less than 16.12-1

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

CVE-2026-2006

CVE-2026-2006 affects PostgreSQL prior to 18.2, 17.8, 16.12, 15.16, and 14.21 due to missing validation of multibyte character length in text manipulation, enabling a crafted query to cause a buffer overrun and execute arbitrary OS-level code. Affected components/versions: PostgreSQL text handlin...

PostgreSQL 安全漏洞

PostgreSQL is a set of free object-relational database management systems developed by the PostgreSQL organization. This system supports most SQL standards and offers many other features, such as foreign keys, triggers, views, etc. Security vulnerabilities existed in versions prior to PostgreSQL...

PT-2026-7843

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.2 PostgreSQL versions prior to 17.8 PostgreSQL versions prior to 16.12 PostgreSQL versions prior to 15.16 PostgreSQL versions prior to 14.21 Description A flaw exists in PostgreSQL due to improper validation of...

CVE-2025-64498 Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. Th...

CVE-2025-64117

CVE-2025-64117 affects Tuleap, where both Community Edition (pre-16.13.99.1761813675) and Enterprise Edition (pre-16.13-5 and pre-16.12-8) lack cross-site request forgery (CSRF) protection in SVN commit rules and immutable tags management. The root cause is missing CSRF protection in the affected...

Enalean Tuleap Community Edition和Enalean Tuleap Enterprise Edition 跨站请求伪造漏洞

Enalean Tuleap Community Edition and Enalean Tuleap Enterprise Edition are both an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A cross-site request forgery vulnerability exists in Enalean Tuleap Community Edition and...

Type confusion

In Foxit Quick PDF Library all versions prior to 16.12, issue where loading a malformed or malicious PDF containing invalid xref entries using the DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access...

Type confusion

In Foxit Quick PDF Library all versions prior to 16.12, issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid xref table data using the LoadFromFile, LoadFromString, LoadFromStream, DAOpenFile or DAOpenFileReadOnly functions may result in an access...

CVE-2018-20248

In Foxit Quick PDF Library all versions prior to 16.12, issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid xref table data using the LoadFromFile, LoadFromString, LoadFromStream, DAOpenFile or DAOpenFileReadOnly functions may result in an access...