The vulnerability of the JDBC driver pgjdbc for connecting Java programs to a PostgreSQL database lies in its use of an unprotected alternative channel, which allows an attacker to exploit the protected information.

The vulnerability of the JDBC driver pgjdbc, which allows Java programs to connect to PostgreSQL databases, is related to the use of an unprotected alternative channel. Exploiting this vulnerability can enable a malicious actor to disclose sensitive information...

CVE-2026-96443

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

EUVD-2026-85178

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-96443

A vulnerability exists in Apache Doris due to insufficient validation of the JDBC driver URL . This flaw allows a privileged user to achieve remote code execution (RCE) on the FE (Front-End) . While the CVSS score indicates a medium severity, the technical impact is described as partial. No speci...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

PT-2026-97263

Name of the Vulnerable Software and Affected Versions Apache Doris affected versions not specified Description Insufficient validation of the JDBC driver URL allows a privileged user to achieve remote code execution on the Front End FE. Recommendations At the moment, there is no information about...

CVE-2026-96443: Inclusion of Functionality from Untrusted Control Sphere

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-15955

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 (Client editions on Linux and Unix ; Windows unaffected) are vulnerable to arbitrary file write via the IBM Data Server driver for JDBC and SQLJ . The root cause is improper validation of file paths (CWE-22 / Path Traversal), allowing a malicious D...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ could allow an evil server to perform an arbitrary file write on the connected client due to improper validation of file paths (CVE-2026-15955)

Summary IBM® Data Server driver for JDBC and SQLJ could allow an evil Db2 server to perform an arbitrary file write on the connected client due to improper validation of file paths. This vulnerability also applies to Db2 due to bundled JDBC and SQLJ components. Vulnerability Details...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...

jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256 authentication with an excessively large iteration...

CVE-2026-85528

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528

Snowflake JDBC Driver versions 4.2.0 through 4.3.3 are affected by improper input validation of the auto-configuration account identifier, allowing a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint . An attacker who controls the account value can cause the...

CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

EUVD-2026-70974

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

PT-2026-85440

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528: Improper Input Validation

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...