CVE-2026-46421: Embedded Malicious Code

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

MAL-2026-10537 Malicious code in neon-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e264a75c066f784e7900ad4f7f51598022eb9c7858fff489dc1861506ca855 neon-postgres is a clone of the porsager/postgres client with package metadata repository, author, homepage still pointing at the upstream project...

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

PYSEC-2026-2341 alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

Oracle Linux 9 : postgresql:18 (ELSA-2026-26204)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26204 advisory. pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Updat...

github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability

A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access cancraft a specially designed SQL DML statementthat is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgr...

PYSEC-2026-1162 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

MAL-2026-7349 Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

dbt (0.20.0rc1), dbt-bigquery (0.20.0rc1) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.0rc1)

dbt-core PYPI version 0.20.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0rc1 - dbt-bigquery 0.20.0rc1 - dbt-postgres 0.20.0rc1 - dbt-presto 0.20.0rc1 - dbt-redshift 0.20.0rc1 - dbt-snowflake 0.20.0rc1 -...

dbt (0.19.1b2), dbt-bigquery (0.19.1b2) +4 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1b2)

dbt-core PYPI version 0.19.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1b2 - dbt-bigquery 0.19.1b2 - dbt-postgres 0.19.1b2 - dbt-presto 0.19.1b2 - dbt-redshift 0.19.1b2 - dbt-spark 0.19.1b2 Source cves:...

dbt (0.17.2b1), dbt-bigquery (0.17.2b1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.2b1)

dbt-core PYPI version 0.17.2b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.2b1 - dbt-bigquery 0.17.2b1 - dbt-postgres 0.17.2b1 - dbt-redshift 0.17.2b1 - dbt-snowflake 0.17.2b1 Source cves: CVE-2024-36105...

dbt (0.18.2), dbt-bigquery (0.18.2) +9 more potentially affected by CVE-2024-36105 via dbt-core (0.18.2)

dbt-core PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.2 - dbt-bigquery 0.18.2 - dbt-clickhouse =0.18.2, =0.18.0rc1, =0.0.1, =0.18.1, =0.18.2 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.20.1rc1), dbt-bigquery (0.20.1rc1) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.1rc1)

dbt-core PYPI version 0.20.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.1rc1 - dbt-bigquery 0.20.1rc1 - dbt-postgres 0.20.1rc1 - dbt-presto 0.20.1rc1 - dbt-redshift 0.20.1rc1 - dbt-snowflake 0.20.1rc1 -...

dbt (0.19.1rc1), dbt-bigquery (0.19.1rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc1)

dbt-core PYPI version 0.19.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc1 - dbt-bigquery 0.19.1rc1 - dbt-postgres 0.19.1rc1 - dbt-redshift 0.19.1rc1 - dbt-spark 0.19.1rc1 Source cves: CVE-2024-36105...

dbt (0.17.0rc3), dbt-bigquery (0.17.0rc3) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.0rc3)

dbt-core PYPI version 0.17.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0rc3 - dbt-bigquery 0.17.0rc3 - dbt-postgres 0.17.0rc3 - dbt-redshift 0.17.0rc3 - dbt-snowflake 0.17.0rc3 Source cves: CVE-2024-361...

dbt (0.17.0rc4), dbt-bigquery (0.17.0rc4) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.0rc4)

dbt-core PYPI version 0.17.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0rc4 - dbt-bigquery 0.17.0rc4 - dbt-postgres 0.17.0rc4 - dbt-redshift 0.17.0rc4 - dbt-snowflake 0.17.0rc4 Source cves: CVE-2024-361...

dbt (0.20.0rc2), dbt-bigquery (0.20.0rc2) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.0rc2)

dbt-core PYPI version 0.20.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0rc2 - dbt-bigquery 0.20.0rc2 - dbt-postgres 0.20.0rc2 - dbt-presto 0.20.0rc2 - dbt-redshift 0.20.0rc2 - dbt-snowflake 0.20.0rc2 -...

dbt (0.19.1rc2), dbt-bigquery (0.19.1rc2) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc2)

dbt-core PYPI version 0.19.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc2 - dbt-bigquery 0.19.1rc2 - dbt-postgres 0.19.1rc2 - dbt-redshift 0.19.1rc2 Source cves: CVE-2024-36105 Source advisory:...