dbt (0.18.1b3), dbt-bigquery (0.18.1b3) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.18.1b3)

dbt-core PYPI version 0.18.1b3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.1b3 - dbt-bigquery 0.18.1b3 - dbt-postgres 0.18.1b3 - dbt-redshift 0.18.1b3 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.18.1), dbt-bigquery (0.18.1) +7 more potentially affected by CVE-2024-36105 via dbt-core (0.18.1)

dbt-core PYPI version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.1 - dbt-bigquery 0.18.1 - dbt-duckdb 0.18.1 - dbt-mysql 0.18.1.1 - dbt-postgres 0.18.1 - dbt-presto 0.18.1 - dbt-redshift 0.18.1 -...

dbt (0.17.1rc4), dbt-bigquery (0.17.1rc4) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.1rc4)

dbt-core PYPI version 0.17.1rc4 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1rc4 - dbt-bigquery 0.17.1rc4 - dbt-postgres 0.17.1rc4 - dbt-redshift 0.17.1rc4 - dbt-snowflake 0.17.1rc4 Source cves: CVE-2024-361...

dbt (0.16.0), dbt-bigquery (0.16.0) +7 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0)

dbt-core PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0 - dbt-bigquery 0.16.0 - dbt-oracle =0.1.3, =0.1.0, =0.2.0 - dbt-snowflake 0.16.0 - dbt-spark 0.16.0 Source cves: CVE-2024-36105 Sour...

dbt (0.17.0rc4), dbt-bigquery (0.17.0rc4) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.0rc4)

dbt-core PYPI version 0.17.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0rc4 - dbt-bigquery 0.17.0rc4 - dbt-postgres 0.17.0rc4 - dbt-redshift 0.17.0rc4 - dbt-snowflake 0.17.0rc4 Source cves: CVE-2024-361...

📄 Tenable Nessus 10.12.0 SQL Injection

A SQL injection vulnerability exists in Tenable Nessus when importing malicious scan result files .nessus XML. Versions 10.12.0 and below are affected. Exploit Title: Tenable Nessus 10.12.1 - SQL Injection CVE: CVE-2026-57588 Date: 2026-06-26 Exploit Author: Mohammed Idrees Banyamer Author Countr...

CVE-2026-42153

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings postgresuser and postgresdb in shell-form commands, allowing an authenticated user to...

CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to...

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 bsc1248707 golang-github-boynux-squidexporter: Non customer facing changes golang-github-lusitaniae-apacheexporter: Non customer...

SUSE-SU-2026:2766-1 Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 bsc1248707 golang-github-boynux-squidexporter: - Non customer facing changes golang-github-lusitaniae-apacheexporter: - Non custom...

GHSA-PMCH-G965-GRMR Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...

PYSEC-2026-527 Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

Summary A SQL injection vulnerability in FilterEngine.createpostgresquery allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgresmeta is...

Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

SummaryA SQL injection vulnerability in FilterEngine.createpostgresquery allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgresmeta is...

postgraas-server vulnerable to SQL injection

A vulnerability, which was classified as critical, was found in Blue Yonder postgraasserver up to 2.0.0b2. Affected is the function createpgconnection/createpostgresdb of the file postgraasserver/backends/postgrescluster/postgresclusterdriver.py of the component PostgreSQL Backend Handler. The...

PT-2026-53539

A vulnerability, which was classified as critical, was found in Blue Yonder postgraas server up to 2.0.0b2. Affected is the function create pg connection/create postgres db of the file postgraas server/backends/postgres cluster/postgres cluster driver.py of the component PostgreSQL Backend Handle...

PT-2026-53596

Summary A SQL injection vulnerability in FilterEngine.create postgres query allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgres meta is...

libpq security update

An update is available for libpq. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libpq package provides the PostgreSQL client library, which allows client...

Oracle Linux 9 : postgresql:16 (ELSA-2026-26203)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26203 advisory. pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pgrepack 1.5.1-1 - Update to v1.5.1...

Oracle Linux 9 : postgresql:15 (ELSA-2026-28037)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-28037 advisory. pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new buil...

GO-2026-5539 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads in go.opentelemetry.io/obi...