postgresql:15 security update

pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 1.5.0-1 - Update to version 1.5.0 Related: 1855776 1.4.0-4 - Bump release for rebuild against libpq-12.1-3 1.4.0-3 - BuildRequires libpq-devel 1.4.0-2 - BuildRequires postgresql-server-devel 1.4.0-1 - Update to 1.4.0...

postgresql:16 security update

pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pgrepack 1.5.1-1 - Update to 1.5.1 postgres-decoderbufs 2.4.0-1.Final - Initial import for postgresql 16 stream - Related: RHEL-3636 postgresql 16.15-1 - Update to 16.15 - Fix...

postgresql:15 security update

pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 1.4.8-1 - Update to version 1.4.8 - Postgresql 15 is supported - Related: 212841...

Oracle Linux 9 : postgresql:15 (ELSA-2026-69914)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69914 advisory. pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new buil...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-054027)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054027 advisory. In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametriz...

faraday v5.24.2

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

CLEANSTART-2026-AU53985 Security fix for GHSA-w879-237q-wc7r applied in: cfssl 1.5.0-r1, postgres-operator 1.12.2-r2, temporal-ui-server-fips 2.51.1-r1

GHSA-w879-237q-wc7r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CQ13514 Security fix for GHSA-q4h4-gmj2-qvw2 applied in: cfssl 1.5.0-r1, postgres-operator 1.12.2-r2, temporal-ui-server-fips 2.51.1-r1

GHSA-q4h4-gmj2-qvw2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QF63101 Security fix for GHSA-9m57-25v3-79x9 applied in: postgres-operator 1.12.2-r2, temporal-ui-server-fips 2.51.1-r1

GHSA-9m57-25v3-79x9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SU14572 Security fix for GHSA-45gg-vh54-h5m9 applied in: cfssl 1.5.0-r1, postgres-operator 1.12.2-r2, temporal-ui-server-fips 2.51.1-r1

GHSA-45gg-vh54-h5m9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-82028

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028

Magistrala versions before 1.0.0 are affected by a SQL injection in the timescale-reader and postgres-reader HTTP API services. The root cause is a malicious format query parameter interpolated directly into the FROM clause without parameterization or identifier quoting. An authenticated attacker...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028: Improper Neutralization of Special Elements used in an SQL Command

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911

CVE-2026-87911 is a CRITICAL (CVSS 9.6) OS command injection vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7. The flaw lies in the read-only enforcement , which can be bypassed by injecting a crafted COPY ... TO PROGRAM statement into con...

EUVD-2026-75127

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...