63 matches found
CVE-2026-120154
A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can bypass Row-Level Security RLS policies, leading to unauthorized information disclosure. By executing iterated INSERT ... ON CONFLICT DO UPDATE statements, an attacker can read protected rows that...
CVE-2026-16237
A flaw was found in PostgreSQL. When handling conflict-resolving insert statements INSERT ... ON CONFLICT on auto-updatable views, the database fails to properly enforce view boundary restrictions. An authenticated attacker with insert and update privileges on a view can exploit this vulnerabilit...
CVE-2026-16237
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
CVE-2026-120154
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
EUVD-2026-124430
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
CVE-2026-16237
PostgreSQL contains a vulnerability in the INSERT ... ON CONFLICT statement when used with auto-updatable views. Due to improper protection, an attacker with INSERT and UPDATE privileges on a view can bypass the view's WHERE condition—regardless of whether it is a security_barrier view—to read or...
CVE-2026-16237
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
CVE-2026-16237 PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
CVE-2026-120154
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
EUVD-2026-124428
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
CVE-2026-120154
PostgreSQL contains a vulnerability in the INSERT ... ON CONFLICT statement where improper protection allows an attacker to bypass row security policies . An attacker with INSERT , UPDATE , and applicable SELECT privileges on a table can read every row by using an iterated INSERT ... ON CONFLICT ...
Vulnerability in core server (CVE-2026-16237)
PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base...
PT-2026-145846
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
PT-2026-145840
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
Vulnerability in core server (CVE-2026-120154)
PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... O...
CVE-2026-120154: n/a PostgreSQL: Improper protection in PostgreSQL INSERT ..
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper...
CVE-2026-16237: n/a PostgreSQL: Improper protection in PostgreSQL INSERT ..
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, wheth...
PT-2026-32458
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...
MiracleLinux 8 : postgresql:10 (AXSA:2021-2311:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2311:01 advisory. postgresql: Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027 postgresql: Memory disclosure in INSERT ... ON...