CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc (CENTOS7:CLSA-2025:1737993791)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1737993791 advisory. - Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc (CENTOS7:CLSA-2024:1734372021)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1734372021 advisory. - Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment...

AlmaLinux 9.2 [TuxCare] Security Update: postgresql-jdbc / postgresql-jdbc-javadoc (ALMALINUX9.2:CLSA-2025:1762243790)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762243790 advisory. - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

EUVD-2026-89198

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CLEANSTART-2026-EP87494 pgjdbc is an open source postgresql JDBC Driver

Security vulnerability affects the sonarqube package. pgjdbc is an open source postgresql JDBC Driver...

CVE-2026-102639: Signed to Unsigned Conversion Error

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

postgresql:12 security update

12.22-12 - add postgresql-CVE-2026-18408.patch 12.22-11 - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch 12.22-10 - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677,...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...

EUVD-2026-88237

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

RLSA-2026:72274 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL code execution in restore operation CVE-2025-8714 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pgdump CVE-2026-18408 For more details about the...

postgresql:12 security update

An update is available for module.pgrepack, module.pgaudit, pgrepack, postgres-decoderbufs, module.postgres-decoderbufs, module.postgresql, postgresql, pgaudit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...