CVE-2026-15741 affecting package postgresql for versions less than 16.15-1

CVE-2026-15741 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14677 affecting package postgresql for versions less than 16.15-1

CVE-2026-14677 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6470 affecting package postgresql for versions less than 16.15-1

CVE-2026-6470 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14663 affecting package postgresql for versions less than 16.15-1

CVE-2026-14663 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14673 affecting package postgresql for versions less than 16.15-1

CVE-2026-14673 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14666 affecting package postgresql for versions less than 16.15-1

CVE-2026-14666 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14679 affecting package postgresql for versions less than 16.15-1

CVE-2026-14679 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

EUVD-2026-44804

NocoBase backup restore schema name allows command injection...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

GHSA-P853-83GJ-WJJ3 NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

CVE-2026-76635

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635

baserCMS before 5.3.0 is vulnerable in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL statements across sequence-update, CSV-export, and table-management operations. This chains with a backup-restore ...

EUVD-2026-63365

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

USN-8653-1 postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...