MiracleLinux 9 : postgresql:16 (AXSA:2026-1882:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1882:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

PT-2026-95650

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description pg partman is a PostgreSQL extension used for managing partitioned tables by time or ID. The functions drop partition id and drop partition time utilize part config.retention schema as the target...

CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

CVE-2026-85878

CVE-2026-85878 is an improper authorization vulnerability in Azure Database for PostgreSQL that allows an authorized attacker to elevate privileges over a network. Microsoft's CNA rates it CVSS 3.1 9.9 (CRITICAL) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity ne...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53557

SQLBot , an intelligent Text-to-SQL system built on LLMs and RAG, contains a second-order SQL injection in its Excel datasource handling. Prior to 1.9.0 , an authenticated user can supply a crafted sheet["tableName"] value via POST /api/v1/datasource/, which is stored without safe identifier hand...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53556

SQLBot , an intelligent Text-to-SQL system, is vulnerable to authenticated SQL injection in the POST /api/v1/datasource/previewData endpoint (prior to v1.9.0 ). The client-controlled table_name parameter is incorporated into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

Azure Database for PostgreSQL Elevation of Privilege Vulnerability

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...

ROOT-APP-MAVEN-CVE-2024-1597 CVE-2024-1597 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

PT-2026-95139

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation RAG. An authenticated user can submit a crafted tableName value within the Excel datasource...

PT-2026-95138

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

PT-2026-95183

Name of the Vulnerable Software and Affected Versions Azure Database for PostgreSQL affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version...